Glimind audits every reachable MCP server it can find — 15,264 as of 2026-10-17 — for how well it works with AI agents. The median server scores 84/100. 29.2% earn an A. Loading a typical server's tool list costs an agent about 2,308 tokens before any work (the top 10% cost 13,995+). A scan of every tool definition for tool-poisoning patterns found 0 servers with manipulative text, 9 that tell models to avoid alternatives, and 28 that run arbitrary code.
servers audited
15,264
median score
84
median tool-list cost
~2,308 tok
manipulative tool text
0
Grade distribution
A
29.2% · 4,453
B
36% · 5,495
C
29.5% · 4,502
D
5.3% · 805
F
0.1% · 9
Most common problems
68.1% — No tool declares an output schema (10,394 servers)
55.4% — Handshake + tool listing slower than 1.5 s (8,459 servers)
46.3% — Tools removed or schemas changed in 30 days (7,073 servers)
42.9% — Tools carry no read-only/destructive hints (6,552 servers)
38.8% — Parameters with no description (5,918 servers)
21.3% — Negotiates a pre-2025-06-18 protocol (3,251 servers)
16% — Several tools share one description (2,439 servers)
11.7% — State-changing tools not marked destructive (1,781 servers)
11.3% — More than 40 tools on one server (1,729 servers)
9.9% — Tool list costs agents 20k+ tokens (or top 10%) (1,518 servers)
5.8% — Under 99% uptime in 30 days (882 servers)
5.5% — Individual tool definitions over ~1,200 tokens (847 servers)
3.1% — Tool definitions require sign-in to read (470 servers)
2.3% — Tool descriptions under 20 characters (355 servers)
Tool poisoning and safety
Every tool name, description and parameter description is scanned for text aimed at the model rather than the user: invisible Unicode tag characters, bidirectional overrides, terminal escapes, instruction overrides, concealment from the user, requests to read credential or MCP config files, conversation exfiltration, cross-tool shadowing and tool-preference manipulation. Rules were checked against every hit on the live corpus to keep false positives out.
0 servers with manipulative tool text (score capped at F).
9 that steer models toward themselves ("always use this tool", "do not use web search").
28 that run arbitrary code or commands supplied by the model.
Each server's own page lists its findings with the exact text. Check one before installing at https://glimind.com/check.
Glimind audits every reachable MCP server it can find — 15,264 as of 2026-10-17 — for how well it works with AI agents. The median server scores 84/100. 29.2% earn an A. Loading a typical server's tool list costs an agent about 2,308 tokens before any work (the top 10% cost 13,995+). A scan of every tool definition for tool-poisoning patterns found 0 servers with manipulative text, 9 that tell models to avoid alternatives, and 28 that run arbitrary code.
How common is MCP tool poisoning?
Across 15,264 reachable servers, 0 carry hidden characters, instruction overrides, concealment, credential-file requests, conversation exfiltration or cross-tool shadowing in their tool definitions. Softer steering is more common: 9 servers tell the model to always use them or to avoid web search and other tools.
How many tokens do MCP tool definitions cost?
Median 2,308 tokens per server, 13,995 at the 90th percentile and 31,973 at the 99th. Many agents load every connected server's definitions into every request.
How is the score calculated?
Static checks of each server's advertised tool list (schemas, descriptions, safety annotations, tool-poisoning patterns, name portability, size) plus observed protocol version, uptime, latency and contract changes. No tool is ever called. Weights: schema 15, descriptions 20, safety 15, token cost 15, compatibility 15, protocol 5, reliability 10, stability 5.
Data: https://glimind.com/v1/readiness (JSON, CC-BY 4.0 — cite "Glimind"). One server per publisher in rankings. Servers are re-audited every few hours.