Every day, Redthread scans the public MCP ecosystem and scores every server it can find against a fixed rule set: Is the source published? Is the target stable? Does it authenticate with a long-lived static secret? Has the listing changed since the last scan — and has the code behind a listing been swapped without changing the listing itself?
Here is where the ecosystem stands in early November 2026:
The numbers
57,277 MCP servers scored — up from 49,092 two weeks earlier. The ecosystem is adding hundreds of net new servers per scan cycle.
1,559 listing swaps detected in this scan cycle — listings whose underlying target changed since the previous scan. A swapped listing inherits the trust of whatever it pointed to before. Anyone who connected on the strength of the old target is now talking to something else.
1,999 servers drifted since the last scan (manifest or tool definitions changed), and 863 tools changed without a version bump — the change is real; the version string says it isn't.
2,356 servers claim the same single source repository — one GitHub repo presented as the source for thousands of distinct listings. Source attribution, as currently practiced, is close to meaningless at the tail of the registry.
19 servers match a rug-pull pattern — tool definitions that changed in the shape of a bait-and-switch.
34% of servers publish no source at all — 19,621 listings asking to be trusted on a name alone.
Why it matters
None of this requires an attacker to be clever. It requires only that agents keep trusting listings the way the ecosystem currently asks them to: by name, indefinitely, with no binding between the listing, the code, and the build that produced it.
That binding is what agent passports are for: short-lived, signed identity for the agent and the tools it calls, bound to the build, revocable the moment the attested state changes. We publish these numbers monthly. Next snapshot: end of November.
Check your own estate
The same scan runs against your own AI estate. Start with the free estate scan at redthreadsec.com — see which agents and tools your company already trusts by name alone.
Methodology: continuous scan of public MCP registries; rules version atf-6; figures from the scan of 5 November 2026; full data at trust.redthreadsec.com.