Study Finds Substantial Fund Transfer and Credential Risks in Public MCP Ecosystem

On November 7, 2026, DEV Community's AI section published a census of the public MCP ecosystem. The researchers froze a SHA-256-anchored snapshot of the public MCP ecosystem on October 12, 2026, covering 42,163 servers and 229,539 tool parameter schemas, and state that every number cited can be recomputed from the frozen exports, with the screening script released under CC0.

According to the findings, 3,456 of those servers ship with a funds-movement surface. Of these, 1,301 have write polarity, meaning their tools can actually move money rather than merely read balances. A further 2,663 servers combine money handling and credential handling within a single trust boundary. The researchers argue that if a prompt injection reaches one of these servers, the blast radius is an actual spend action rather than a read-only one, since the tools operate with the permissions the server declares. They also caution that the figures cover only the public ecosystem, with enterprise-internal MCP deployments excluded from the census. As of the publication, no follow-up developments or responses from server operators were reported.