{"slug": "i-tried-to-start-182-mcp-servers-65-answered", "title": "I tried to start 182 MCP servers. 65 answered", "summary": "A new harness that actually starts and tests Model Context Protocol (MCP) servers found that only 65 of 182 servers (36%) connected and listed their tools, while 83 (46%) failed to start unattended and 33 (18%) needed credentials that were withheld. The median time for a working server to become usable was 13.2 seconds, and a scan of 2,617 tool descriptions found zero malicious injections, with five benign matches across four servers.", "body_md": "# I tried to start 182 MCP servers. 65 answered.\n\nEvery published count of the MCP ecosystem counts *packages*. None of them counts\nworking software, because checking would mean starting the servers — so we built a\nharness that does: it connects on a schedule, asks each server to list its tools, and\nrecords every attempt.\n\nHere is the first real batch. (We argued the counting problem at length in\n[the previous post](/blog/how-many-mcp-servers), which also admitted we had never\nchecked either. This is that gap closed.)\n\n| Outcome | Servers | Share | \n|---|---|---|\n| **Verified** — connected and listed its tools | **65** | 36% | \n| Failed to start unattended | 83 | 46% | \n| Needed credentials we withheld | 33 | 18% | \n| Unsupported — we can't run it here | 1 | 0.5% | \n\n## Read the failures carefully, because we don't\n\n**We supply no credentials and allow 45 seconds.** That is a deliberate choice — the\nharness exists to find out what a server does with a hostile-by-default environment,\nnot to make servers look good. It also means the failure column is substantially *our*\ndoing.\n\nA server that wants an API key we declined to give it has not failed. A server that needs three minutes to install a browser engine has not failed. We separate these because collapsing them into \"broken\" would be a false claim about someone else's project, published at scale, with our name on it:\n\n- **needs credentials** — refused for want of auth we intentionally withheld\n- **failed to start** — didn't come up, and not obviously an auth problem\n- **unsupported** —*we* can't run it: no install command, or it targets another OS\n\nThat last category exists because the first run turned one up immediately: a macOS-only package on our Linux runner. That is our limitation, not a defect, and calling it one would have been wrong.\n\nSo **36% is a floor on how many of these servers work**, not a measurement of how many\ndon't. If you want a headline number, that is the only honest one available.\n\n## The finding we didn't go looking for\n\nThe servers that do start take a long time to become usable:\n\n| Median time to a usable tool list | **13.2s** | \n| 90th percentile | 28.3s | \n| Slowest observed | 43.8s | \n\nThirteen seconds is the *median*. Add four servers to your client config and you are\nwaiting the better part of a minute before the agent can do anything, every session,\nbecause `npx` re-resolves the package each time.\n\nNobody publishes this because measuring it requires actually starting the servers. It is the strongest practical argument we have found for connecting on demand rather than pre-loading everything, and we found it by accident while measuring something else.\n\n## We scanned the tool descriptions. They're clean.\n\nConnecting to servers produces a corpus nobody else has: **2,626 tool definitions from\n85 servers**, 2,617 of them carrying a description, and every one carrying an input\nschema.\n\nThat corpus is also an attack surface. Tool poisoning — [CVE-2025-54136](https://nvd.nist.gov/vuln/detail/CVE-2025-54136),\n\"MCPoison\" *(secondary source)* — hides instructions inside a tool's *description*,\nwhich MCP hands to the model unsanitised. A description is documentation; text telling\nthe assistant to ignore prior instructions, or to conceal what it did, is something\nelse.\n\nWe scan every description against the published patterns on every verification, and re-ran the same scanner across the whole stored corpus of 2,617 descriptions for this post.\n\n**Five matches across four servers. All five benign on inspection:**\n\n- two documentation servers saying *\"You MUST use this tool if you're unsure about…\"* —\npushy, and honest about it\n- an SSH server naming the `~/.ssh` paths it exists to read\n- two tools on a hosting provider that manage `.env` variables, and say so\n\nZero injections. That is the headline, and we would rather publish it than sit on it waiting for something more dramatic. A scanner that has never fired is worth nothing; one that fires at a rate a human can review, and whose hits all turn out legitimate, is calibrated.\n\n**These are flags for review, never verdicts.** A regular expression cannot tell a usage\nhint from an injection, and we do not publish flags against named servers as\naccusations.\n\n## Are any of these commercial?\n\nOf the 85 verified servers, **14 have tools whose descriptions reference pricing,\nquotas, free tiers or upgrades** — but on inspection that means *the service behind the\nserver* is commercial (Microsoft 365, Bitwarden, Figma), not that the server is a paid\nproduct.\n\nWe initially wrote that we had found no example of an MCP server that is itself sold. That was wrong, and the way it was wrong is more interesting than the claim.\n\nDevart — a long-established database tooling vendor — [sells a line of 20 MCP\nservers](https://www.devart.com/mcp/), licensed perpetually or by subscription, with a\ntrial. They are a commercial product in the ordinary sense.\n\n**Our index contains none of them.** Searching it for \"devart\" or \"dbforge\" returns\nnothing, because they ship as licensed downloads rather than as npm or PyPI packages,\nand our crawler only sees public package registries and GitHub.\n\nSo there is a whole category of MCP server that is invisible to us, and to every other\ncount built the same way — which is to say, all of them. The [previous\npost](/blog/how-many-mcp-servers) argued that every published figure depends on an\nunstated definition. This is a sharper version of the same problem: **commercially\ndistributed servers don't appear in anyone's numbers, including ours**, and we only\nnoticed because a vendor's release note happened to cross our desk.\n\nWe still have no idea how large that category is. Neither, as far as we can tell, does anyone else.\n\n## What we don't claim\n\n- **Not that 46% of MCP servers are broken.** We withheld credentials and allowed 45\nseconds. Most of that column is our harness.\n- **Not that this sample represents the ecosystem.** 182 attempts against ~41,900\nrunnable entries, ordered by downloads, so it is biased toward popular npm packages.\n- **Not that our index is complete.** It is built from public package registries and\nGitHub, so commercially distributed servers — sold as licensed downloads — are absent\nentirely. We found one such vendor by accident and have no way to estimate how many\nmore exist.\n- **Not that the scan proves safety.** It matches published patterns in descriptions.\nIt cannot see what a server does at runtime, and it does not inspect tool*responses* — the runtime-injection channel remains the significant unsolved problem, industry-wide.\n- **Not that startup latency is anyone's fault.** Much of it is`npx` resolving packages,\nwhich is a packaging characteristic, not a server defect.\n- **We are not neutral.** We run a registry and a gateway. The method is described so it\ncan be argued with; the numbers come from a public API.\n\n## Reproduce it\n\nEvery verification is a row, and the result is on the public API:\n\n```\ncurl -s \"https://mcprating.io/api/v1/servers/notionhq-notion-mcp-server\" | jq .verification\n{ \"lastVerifiedAt\": \"...\", \"verifiedCount\": 1, \"attemptCount\": 1, \"latestOutcome\": \"verified\" }\n```\n\n`null` means we have never attempted that server — **not that it is broken**. At the\ntime of writing that is true of the overwhelming majority of the index, and it will stay\ntrue for a long time.\n\n*The pass runs weekly and the history is append-only, so the interesting number isn't\ntoday's snapshot — it's which servers stop working, and when.*", "url": "https://wpnews.pro/news/i-tried-to-start-182-mcp-servers-65-answered", "canonical_source": "https://mcprating.io/blog/i-tried-to-start-182-mcp-servers", "published_at": "2026-09-08 13:34:03+00:00", "updated_at": "2026-09-08 13:56:43.874590+00:00", "lang": "en", "topics": ["ai-tools", "ai-infrastructure", "ai-safety"], "entities": ["MCP", "CVE-2025-54136"], "alternates": {"html": "https://wpnews.pro/news/i-tried-to-start-182-mcp-servers-65-answered", "markdown": "https://wpnews.pro/news/i-tried-to-start-182-mcp-servers-65-answered.md", "text": "https://wpnews.pro/news/i-tried-to-start-182-mcp-servers-65-answered.txt", "jsonld": "https://wpnews.pro/news/i-tried-to-start-182-mcp-servers-65-answered.jsonld"}}