The MCP package looked clean. The installed tree did not.

We audited 31 MCP server packages across npm and PyPI.

For each one, we ran two checks:

a direct check of the top-level package

a scan of the installed dependency tree

The direct package check found 1 finding.

The installed trees found 69.

The installed-tree findings were not just low-severity noise:

The Operational Lesson

For MCP, the thing worth scanning is not only the package identifier.

It is the installed tree.

That means:

resolve the package

install it in isolation

capture the actual installed version

scan runtime dependencies

record registry metadata such as deprecation and yanked-release status

This matters because MCP is not confined to npm. In this audit, almost one-third of the targets were PyPI packages. Any MCP scanning program that only understands npm is incomplete by design.

Why This Version Is Aggregate

This version keeps target names out of the article. Some results are tied to active maintainers, so named evidence should go through direct notification first.

The aggregate finding is still actionable:

Direct package checks are not enough for MCP infrastructure. Operators need installed-tree scans.

That is the part teams can fix today.

Bindfort Research is expanding this work into a broader MCP ecosystem audit. Maintainers and operators who want to compare results privately can contact [email protected].