What you're actually installing
We scanned all 4,269 repositories in the Claude Code ecosystem on 2026-10-23 for licence, maintenance and provenance. 838 of them, 19.6%, expose no licence a machine can read, so nobody can clear them without opening the file by hand. Every figure on this page is recomputed from the CSV we publish, and the command to check it is at the bottom.
838 repositories cannot be cleared automatically
19.6% of the ecosystem exposes no machine-readable OSI licence. These are two different failure modes with one shared consequence: a person has to open the file before your company ships anything that touches it. Reporting only the 450 with no licence understates it; merging the two without showing the split overstates it.
- No licence at allDefault copyright: all rights reserved
- 450
- Licence not identifiableGitHub finds the file but cannot identify it
- 388
- Recognised OSI licenceAdoptable without a read
- 3,431
Unidentified rarely means careless
The largest NOASSERTION repositories in the catalogue are not weekend projects. A detector returns NOASSERTION when a project ships a modified or bespoke licence, and in this ecosystem that usually means source-available with commercial or branding conditions. A company that greps for the presence of a LICENSE file ships these without knowing.
- n8n-io/n8n208,377 ★
- langgenius/dify159,339 ★
- open-webui/open-webui156,544 ★
- lobehub/lobehub83,440 ★
- code-yeongyu/oh-my-openagent70,287 ★
The result that cuts against our own framing
54% of the catalogue are not MCP servers. On licences they are worse than MCP. On maintenance they are better. The two comparisons point in opposite directions and we publish them that way because that is what the file says.
| n | No readable licence | Unmaintained | |
|---|---|---|---|
| MCP servers | 1,976 | 14.5% | 15.9% |
| Everything else | 2,293 | 24% | 17.2% |
104 MCP servers are AGPL-3.0
Of 165 AGPL-3.0 repositories in the catalogue, 104 are MCP servers. This is not a defect: AGPL is a legitimate and widely used licence. It matters because an MCP server runs as a network service, which is precisely the case AGPL section 13 was written for. If you deploy one for others to use, read it first.
79 READMEs document an install that pipes a remote script into a shell
33 of them are MCP servers. This is the only measurement in this census that describes code executing on your machine at install time. A method caveat that matters: it is a pattern match over the README, not a verified install path, so some cases will be documentation examples. We publish the raw count rather than a hand-curated one, because a curated figure could not be reproduced from the file we publish.
What this scan is not
This is not a security audit and this page no longer claims to be one. Of 1,770 flags across the catalogue, 94.5% are metadata hygiene: no licence, no description, unmaintained. The scanner measures licence, maintenance and provenance. For deep MCP security analysis with rule identifiers and severity tiers, better work than ours exists and we are not going to pretend otherwise.
By category
| Category | n | No licence | Unidentified | No readable licence | Unmaintained |
|---|---|---|---|---|---|
| MCP servers | 1,976 | 123 | 164 | 14.5% (287) | 15.9% |
| Subagents | 883 | 53 | 101 | 17.4% (154) | 7.6% |
| Tools | 721 | 177 | 59 | 32.7% (236) | 34.7% |
| Skills | 454 | 45 | 50 | 20.9% (95) | 7.9% |
| Awesome lists | 134 | 32 | 12 | 32.8% (44) | 16.4% |
| Plugins | 80 | 13 | 2 | 18.8% (15) | 15% |
| Templates | 11 | 3 | 0 | 27.3% (3) | 18.2% |
| Hooks | 10 | 4 | 0 | 40% (4) | 60% |
Hooks (n=9) and templates (n=11) are shown with their raw counts but are samples too small to read as a percentage.
Reproduce these figures
Every number on this page comes from the file we publish, under CC BY 4.0. Download it and check.
curl -s https://claudewave.com/api/dataset/repos.csv -o repos.csv
python3 - <<'EOF'
import csv
rows = list(csv.DictReader(open('repos.csv')))
unclear = [r for r in rows if (r['license'] or '').strip() in ('', 'NOASSERTION')]
print(len(unclear), 'of', len(rows), f"({100*len(unclear)/len(rows):.1f}%)")
EOFMCP servers in detail
Around a third of all MCP servers (30%) carry at least one risk signal. The most common is not malicious code but abandonment: 16% have not received a commit in over six months, which in a protocol as young as MCP means unpatched endpoints and dependencies.
6% ship with no license at all. Without explicit usage terms, deploying one of these servers in a company setting is legally ambiguous even when the code itself is benign.
33 servers tell users to pipe a remote script straight into a shell (curl | bash). It is the highest-risk install pattern there is: it runs arbitrary code before you can review it. We recommend cloning and reading first.
Most common flags
- Licence file present but not machine-readable164
- Inactive (>180d)160
- Stale (last commit over a year ago)155
- No license declared123
- No description42
- Install pipes a remote script into a shell (curl | sh)33
- Brand-new repo with thousands of stars (suspicious)3
- README contains suspicious pattern: eval\s*\(2
Safest (Trust 90+)
- morluto/rea100369.9k
- google-gemini/gemini-cli100107.6k
- koala73/worldmonitor10089.3k
- D4Vinci/Scrapling10089.3k
- netdata/netdata10081.1k
- upstash/context710063.5k
- sansan0/TrendRadar10063.1k
- MemPalace/mempalace10059.7k
- aaif-goose/goose10055.6k
- ChromeDevTools/chrome-devtools-mcp10054k
- reactive-resume/reactive-resume10044.7k
- Kong/kong10044.3k
Popular but flagged
Widely-used servers (50+ stars) with the lowest Trust Score. This does not imply malware: review the flags before installing.
Methodology and data
The Trust Score (0-100) is heuristic: maintenance, fork ratio, licence, owner reputation, repository age, documentation and suspicious README patterns. It covers 100% of the MCP servers in the index and is recomputed nightly against that day's catalogue. Separately, 10 repositories carry an additional AI review, shown on their page where it exists. The full set is downloadable under CC BY 4.0. Cite this report as “ClaudeWave, The State of MCP Security 2026 (claudewave.com)”.
Last scan: · full coverage