The most common MCP bug is one missing sentence

In the last week of October we tested 365 public MCP servers from the official MCP Registry. The good news is better than we expected: no hidden instructions and no leaked secrets anywhere. The most common problem is small and easy to fix, and it's in half of them.

State of MCP servers, October 2026 · published 27 October 2026 · tests run 18–26 October 2026 · all numbers as data

365 servers, 1,806 tools

365public MCP servers tested; 362 answered

88average score out of 100, of the 129 we could test fully

14tools per server on average; the largest has 60

Two in three servers (233, or 64%) need a login before they show a single tool, so for those we could only check the outside. Their login setup is mostly right: 207 of the 219 we checked follow the rules AI apps use to sign in. The 129 servers we could test fully did well:

90–100: 63 servers (10 perfect)70–89: 64below 70: 2

No hidden instructions. No leaked secrets.

Tool descriptions can carry text meant for the AI rather than for people, a trick known as tool poisoning. We read every description of every server we could reach and found none. We also sent bad inputs to every tool we could safely run and read the error messages for keys, passwords and tokens. None leaked.

Servers with hidden instructions in a tool description0% 0 of 129

Servers whose error messages leaked a secret0% 0 of 110110 servers had error messages we could check.

Servers needing a login whose login setup passed95% 207 of 219

Small gaps that make AI apps guess

Tool inputs with no description51% 66 of 129

Accepts the wrong type of input without complaint26% 27 of 102Of the 102 servers where tools could run in safe mode.

Still on an older MCP version25% 90 of 362

Tools that are nearly identical9% 11 of 129

Answers so big that AI apps cut them off6% 8 of 129

A tool that crashes or never answers3% 4 of 129

The missing sentence: inputs with no description66 of 129 servers (51%) have tools whose inputs aren't described. The usual suspects are limit, id, slug and locale.Why it matters: the AI reads descriptions to decide what to send. Without one, it guesses: a limit of 10 or 10,000, an id from the wrong list.The fix: one sentence per input, like "Maximum results, 1–50" or "Order id, like ORD-123".

Wrong input, no complaint27 of the 102 servers we could run (26%) accepted the wrong type of input, a number where text belongs, without an error. 7 accepted a missing required input.Why it matters: when an AI gets an input wrong, a clear error lets it fix the call. Silence means a wrong answer the AI treats as right.The fix: validate inputs and return a short tool error that says what's expected.

An older MCP version90 of the 362 servers that answered (25%) don't support the July 2026 MCP version yet.Why it matters: everything works today, but newer AI apps prefer the new version first.The fix: update the MCP SDK.

Look-alike tools, huge answers, tools that hang11 servers have tools with nearly the same description, 8 send answers so large that many AI apps cut them off, and 4 have a tool that crashes or never answers.Why it matters: each one makes an AI pick the wrong tool, lose the end of an answer, or wait forever.The fix: say how look-alike tools differ, page large answers, and put a time limit on slow calls.

Tools that don't say if they're safe156 of 1,806 tools (9%) carry no safety label: they don't say whether they only read, or can change or delete things.Why it matters: AI apps use these labels to decide when to ask you first. No label means the app has to assume the worst.The fix: add readOnlyHint or destructiveHint (and ideally idempotentHint and openWorldHint) to every tool, truthfully.

Clean this week doesn't mean clean forever

We found no hidden instructions in these 365 servers. But a server can change after you install it, and many servers aren't in any public list. Before you add one to Claude, Cursor or another AI app, paste its link into the free test. It reads every tool description, shows which tools can change, send or delete things, and runs nothing that could.

How we tested, and what that means for the numbers

Which serversPublic remote servers listed in the official MCP Registry, tested between 18 and 26 October 2026. That leans toward newer servers, and it isn't every MCP server in the world.

Safe modeWe only ran tools the server labels read-only, and never tools that sound destructive. Everything else was read, not run.

Logins233 servers need a login, so we checked only their public side: whether they answer and whether their login setup follows the rules.

The same test anyone can runEvery number comes from the free QAmcp test, the same one at qamcp.dev/test.html and in npx qamcp-cli. The checks and the score are explained in How it works.

No namesThis report counts problems; it doesn't single out servers. Each server's own results are on its page in the directory.

Use the numbersThe figures are in one data file, free to reuse with credit to QAmcp (qamcp.dev).