Lethal trifecta paths in 630 public MCP configs
Measured on 2 November 2026.
We ran our MCP check on 630 distinct MCP configurations from public GitHub repositories. 106 of them (16.8%) give one agent a complete lethal trifecta. That agent can read what strangers can write, read private data and send data out. The more servers an agent has, the likelier it is.
What we counted
The check reads a configuration, not a running agent. For each server, it looks for three things.
- Untrusted content. Web pages, public issues, email.
- Private data. Repositories a token reaches, local files, a mailbox.
- An exit. Email, chat, HTTP, DNS, code with network access, or a shared write.
A configuration has a trifecta when all three are present. An agent has one context, so whatever one server brings in, any other can send out.
The headline counts only exits that servers provide. By default, the MCP check also counts images and link previews that the chat client renders. With those, it’s 121 (19.2%).
What we found
106 of 630 configurations (16.8%; 95% CI 14.1–20.0%) have a complete trifecta. Most configurations are small. The median has one server. Most trifectas come from one server that completes all three by itself. GitHub’s server does in 52 of them. The share climbs with the number of servers.
| Servers | Configurations | With a trifecta |
|---|---|---|
| 1 | 424 | 6.8% |
| 2 | 96 | 18.8% |
| 3 or 4 | 71 | 43.7% |
| 5 to 9 | 30 | 66.7% |
| 10 or more | 9 | 88.9% |
How we sampled
- 34 read-only GitHub code searches, on 2 November 2026, for Claude Desktop, Cursor, VS Code and Claude Code configuration files.
- 1,099 results became 852 distinct sets of servers. We set aside 222 templates and examples, leaving 630.
- Secrets were masked as files were read, and the downloads were deleted. We publish no repository names.
Limits
- These aren’t production agents. Most are developers’ own project and personal setups.
- It isn’t a random sample. Code search ranks and caps its results, and each client got the same share of the sample.
- The check is static and name-based. It couldn’t classify 55% of servers and counts them as harmless. Counting only servers it recognizes by package or endpoint gives 11.1%.
- GitHub’s server is in almost half of them. The check counts it as a trifecta by itself. Without it, the share is 11.3%.
- A path isn’t an attack. It means the tools sit in one agent together. The check doesn’t know a token’s scopes, whether the client asks before each call, or the network’s rules.
The scripts and the aggregate data are available on request: founders@dyeline.ai.