As AI coding agents (Claude Code, Cursor, Windsurf, GitHub Copilot, and Zed) rapidly adopt the Model Context Protocol (MCP), repositories are shipping .mcp.json configs, tool definitions, and agent workflows faster than security teams can review them.
To measure the real-world security posture and LLM token efficiency across the ecosystem, I ran RepoXray (npx rxray)—an open-source, zero-dependency static security & supply-chain scanner—against 10 widely used MCP repositories on GitHub.
⚡ Audit Snapshot (TL;DR)
- Total Files Scanned:
4,409files across 10 popular MCP repos - Average Scan Speed:
1.53 secondsper repository (100% local static analysis) - Supply-Chain Risk: 70% of scanned repos contained dependencies with known CVEs
- Context Bloat: 100% lacked an
.aiignorefile, wasting 2.17M+ tokens on lockfiles and build artifacts
📊 Aggregate Findings Across 10 MCP Repositories
| Repository | Score | Grade | Scan Time | 🔴 Critical | 🟠 High | 🟡 Med | Optimizable LLM Tokens |
|---|---|---|---|---|---|---|---|
tavily-ai/tavily-mcp | 99/100 | 🟢 A+ | 0.77s | 0 | 0 | 1 | 15,073 (46%) |
modelcontextprotocol/servers | 91/100 | 🟢 A | 1.49s | 0 | 0 | 5 | 335,953 (24%) |
lastmile-ai/mcp-agent | 68/100 | 🟡 C | 0.89s | 1 | 0 | 1 | 925,638 (34%) |
executeautomation/mcp-playwright | 68/100 | 🟡 C | 1.67s | 1 | 1 | 1 | 340,576 (74%) |
browserbase/mcp-server-browserbase | 68/100 | 🟡 C | 0.98s | 1 | 2 | 1 | 58,969 (67%) |
mendableai/firecrawl-mcp-server | 68/100 | 🟡 C | 1.15s | 1 | 1 | 1 | 119,947 (26%) |
excalidraw/excalidraw-mcp | 64/100 | 🟡 C | 2.80s | 2 | 4 | 2 | 38,593 (43%) |
modelcontextprotocol/inspector | 63/100 | 🟡 C | 2.62s | 4 | 5 | 2 | 179,301 (4%) |
punkpeye/fastmcp | 50/100 | 🟠 D | 1.57s | 3 | 9 | 1 | 68,102 (11%) |
upstash/context7 | 28/100 | 🔴 F | 1.42s | 12 | 4 | 1 | 87,521 (10%) |
Note: Scans were executed against the default branch of each repository using
npx rxray. Scores reflect static security rules, OSV.dev advisory lookups, and AI context hygiene.
🔍 3 Key Takeaways From the Audit
1. 70% of Scanned Repos Have Dependencies With Known CVEs (SC-OSV-VULNERABILITY)
7 out of 10 repositories contained direct or transitive manifest versions with security advisories published in OSV.dev.
Why this matters for MCP: Unlike sandboxed web apps, MCP servers execute locally on developer workstations—frequently holding privileges to read/write local filesystems, control headless browsers, and access production API keys. A vulnerable dependency inside an MCP server carries immediate local code execution risk.
2. Unpinned npx -y and Mutable Git References in MCP Configs
Several MCP configurations and README setup guides instruct developers to launch servers using mutable targets:
- Unpinned Registry Execution (
SEC-MCP-UNPINNED-NPX): Runningnpx -y some-mcp-server@latestauto-downloads and executes whatever version was pushed most recently without user confirmation. - Mutable Git Branches (
SC-MCP-UNPINNED-GIT): Usingnpx github:owner/repooruvx --from git+https://...without pinning to an immutable 40-character commit SHA.
The Risk: If an upstream npm maintainer account is hijacked or a Git tag is force-pushed, every developer opening their IDE automatically pulls and executes the malicious payload on startup.
json // ❌ Risky: Pulls latest unverified code on every IDE startup { "mcpServers": { "example": { "command": "npx", "args": ["-y", "some-mcp-server@latest"] } } } // ✅ Safer: Pin to an exact, audited version { "mcpServers": { "example": { "command": "npx", "args": ["some-mcp-server@1.4.2"] } } } 3. 100% Lacked an .aiignore File — Wasting 2.17 Million Context Tokens None of the 10 repositories included an .aiignore (or .cursorignore / .claudeignore) file. Across the 10 repos, 2,169,673 tokens came purely from lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock), minified bundles, and static JSON fixtures. When coding agents index a repository without context ignore rules, this noise pollutes the LLM context window, increases API costs, and degrades reasoning quality. 🛠️ Test Your Own Repository in <2 Seconds (Zero Dependencies) You can run the exact same audit on your own codebase locally (zero telemetry—no code ever leaves your machine) or directly in the browser: # 1. Instant terminal security & token audit npx rxray . # 2. Generate a Markdown report table for GitHub PRs / Issues npx rxray . --markdown # 3. Auto-compile .aiignore and AGENTS.md guardrails npx rxray compile . 🔗 Links & Resources 🌐 Live Browser Scanner (100% Client-Side): repoxray.pages.dev 📦 npm Package: npmjs.com/package/rxray ⭐ GitHub Repository (MIT, 0 runtime dependencies): 
Ra9mirez11 / repoxray
Zero-upload security, supply-chain, AI slopsquatting, secret leak, and LLM context X-Ray for any codebase (Web + 0-dep npx CLI).
RepoXray (rxray)
Catch leaked keys, malware tombstones, OSV vulnerabilities, AI slopsquatting, and LLM context bloat before you push.
- Browser App (100% Web Worker, 0 bytes uploaded): https://repoxray.pages.dev
- Live Self-Audit Demo: https://repoxray.pages.dev/?repo=Ra9mirez11/repoxray
- 5-Letter Zero-Dependency CLI:
npx rxray . Why RepoXray Exists
Modern development moves fast with AI coding agents, MCP servers, and thousands of open-source packages. Traditional scanners miss the failure modes that break teams today:
- AI Slopsquatting, Malware Tombstones & Unpinned Git Installs (
SC-SLOPSQUATTING-404 / SC-NPM-SECURITY-TOMBSTONE / SC-MCP-UNPINNED-GIT): LLMs frequently hallucinate plausible package names, reference taken-down malicious packages (0.0.1-security), or invoke mutable Git URLs (npx github:owner/repo, uvx --from git+https://...) without a commit SHA. RepoXray checks live registry existence, package age (< 21 days), wrong-registry MCP servers (uvx vs npm), lookalike vendor scopes (@anthropic/ vs @anthropic-ai/), and commit-SHA pinning on Git installs. - Malicious Lifecycle Hooks (
SC-MALICIOUS-LIFECYCLE-HOOK…
Have you audited your .mcp.json or local MCP servers yet? Drop your repository's score in the comments below!
