What you're actually installing
We scanned all 4,282 repositories in the Claude Code ecosystem on 2026-09-12 for licence, maintenance and provenance. 903 of them, 21.1%, expose no licence a machine can read, so nobody can clear them without opening the file by hand. Every figure on this page is recomputed from the CSV we publish, and the command to check it is at the bottom.
903 repositories cannot be cleared automatically
21.1% of the ecosystem exposes no machine-readable OSI licence. These are two different failure modes with one shared consequence: a person has to open the file before your company ships anything that touches it. Reporting only the 516 with no licence understates it; merging the two without showing the split overstates it.
- No licence at allDefault copyright: all rights reserved
- 516
- Licence not identifiableGitHub finds the file but cannot identify it
- 387
- Recognised OSI licenceAdoptable without a read
- 3,379
Unidentified rarely means careless
The largest NOASSERTION repositories in the catalogue are not weekend projects. A detector returns NOASSERTION when a project ships a modified or bespoke licence, and in this ecosystem that usually means source-available with commercial or branding conditions. A company that greps for the presence of a LICENSE file ships these without knowing.
- n8n-io/n8n204,045 ★
- langgenius/dify155,468 ★
- open-webui/open-webui151,680 ★
- JuliusBrussee/caveman105,053 ★
- lobehub/lobehub82,411 ★
The result that cuts against our own framing
54% of the catalogue are not MCP servers. On licences they are worse than MCP. On maintenance they are better. The two comparisons point in opposite directions and we publish them that way because that is what the file says.
| n | No readable licence | Unmaintained | |
|---|---|---|---|
| MCP servers | 1,975 | 15.5% | 16.6% |
| Everything else | 2,307 | 25.9% | 12.1% |
88 MCP servers are AGPL-3.0
Of 149 AGPL-3.0 repositories in the catalogue, 88 are MCP servers. This is not a defect: AGPL is a legitimate and widely used licence. It matters because an MCP server runs as a network service, which is precisely the case AGPL section 13 was written for. If you deploy one for others to use, read it first.
73 READMEs document an install that pipes a remote script into a shell
25 of them are MCP servers. This is the only measurement in this census that describes code executing on your machine at install time. A method caveat that matters: it is a pattern match over the README, not a verified install path, so some cases will be documentation examples. We publish the raw count rather than a hand-curated one, because a curated figure could not be reproduced from the file we publish.
What this scan is not
This is not a security audit and this page no longer claims to be one. Of 1,744 flags across the catalogue, 95% are metadata hygiene: no licence, no description, unmaintained. The scanner measures licence, maintenance and provenance. For deep MCP security analysis with rule identifiers and severity tiers, better work than ours exists and we are not going to pretend otherwise.
By category
| Category | n | No licence | Unidentified | No readable licence | Unmaintained |
|---|---|---|---|---|---|
| MCP servers | 1,975 | 150 | 156 | 15.5% (306) | 16.6% |
| Subagents | 896 | 67 | 107 | 19.4% (174) | 5.7% |
| Tools | 745 | 192 | 64 | 34.4% (256) | 23.2% |
| Skills | 437 | 51 | 46 | 22.2% (97) | 5.7% |
| Awesome lists | 138 | 35 | 11 | 33.3% (46) | 13% |
| Plugins | 72 | 13 | 3 | 22.2% (16) | 6.9% |
| Templates | 10 | 4 | 0 | 40% (4) | 30% |
| Hooks | 9 | 4 | 0 | 44.4% (4) | 55.6% |
Hooks (n=9) and templates (n=11) are shown with their raw counts but are samples too small to read as a percentage.
Reproduce these figures
Every number on this page comes from the file we publish, under CC BY 4.0. Download it and check.
curl -s https://claudewave.com/api/dataset/repos.csv -o repos.csv
python3 - <<'EOF'
import csv
rows = list(csv.DictReader(open('repos.csv')))
unclear = [r for r in rows if (r['license'] or '').strip() in ('', 'NOASSERTION')]
print(len(unclear), 'of', len(rows), f"({100*len(unclear)/len(rows):.1f}%)")
EOFMCP servers in detail
Around a third of all MCP servers (31%) carry at least one risk signal. The most common is not malicious code but abandonment: 17% have not received a commit in over six months, which in a protocol as young as MCP means unpatched endpoints and dependencies.
8% ship with no license at all. Without explicit usage terms, deploying one of these servers in a company setting is legally ambiguous even when the code itself is benign.
25 servers tell users to pipe a remote script straight into a shell (curl | bash). It is the highest-risk install pattern there is: it runs arbitrary code before you can review it. We recommend cloning and reading first.
Most common flags
- Inactive (>180d)166
- Stale (last commit over a year ago)162
- Licence file present but not machine-readable156
- No license declared150
- No description52
- Install pipes a remote script into a shell (curl | sh)25
- README contains suspicious pattern: eval\s*\(9
- Many open issues + slow updates2
Safest (Trust 90+)
- google-gemini/gemini-cli100106.9k
- koala73/worldmonitor10086.1k
- netdata/netdata10080.5k
- D4Vinci/Scrapling10080.3k
- sansan0/TrendRadar10062.2k
- upstash/context710061.9k
- MemPalace/mempalace10059k
- rohitg00/ai-engineering-from-scratch10054.3k
- aaif-goose/goose10054.1k
- ChromeDevTools/chrome-devtools-mcp10051.7k
- heygen-com/hyperframes10049k
- Kong/kong10044.1k
Popular but flagged
Widely-used servers (50+ stars) with the lowest Trust Score. This does not imply malware: review the flags before installing.
Methodology and data
The Trust Score (0-100) is heuristic: maintenance, fork ratio, licence, owner reputation, repository age, documentation and suspicious README patterns. It covers 100% of the MCP servers in the index and is recomputed nightly against that day's catalogue. Separately, 10 repositories carry an additional AI review, shown on their page where it exists. The full set is downloadable under CC BY 4.0. Cite this report as “ClaudeWave, The State of MCP Security 2026 (claudewave.com)”.
Last scan: · full coverage