// RESEARCH
MCP security research
Original MCP security research, built from PolicyLayer's continuously-updated catalogue of 517,973 classified tools across 32,820 public MCP servers. Each audit measures what Model Context Protocol servers can actually do to the systems behind them — which can destroy data, execute commands, or move money — and names the servers carrying the most risk. Updated monthly.
In progress
- State of MCP Approval Gates — how much destructive surface sits behind any approval logic.
- State of MCP OAuth — coverage of OAuth and RFC 8707 Resource Indicators across the ecosystem.
Take your agents live. Without losing control.
Route your MCP traffic through PolicyLayer. Every tool call is checked against your policy before it runs: allow, deny, or require approval. Per-identity grants. Full audit log. Live in minutes.
Instant setup, no code required.
46,500+ MCP servers and 515,000+ tools scanned and risk-classified.