Glimind audits every reachable MCP server it can find — 15,290 as of 2026-10-17 — for how well it works with AI agents. The median server scores 84/100. 29% earn an A. Loading a typical server's tool list costs an agent about 2,307 tokens before any work (the top 10% cost 13,993+). A scan of every tool definition for tool-poisoning patterns found 0 servers with manipulative text, 9 that tell models to avoid alternatives, and 28 that run arbitrary code.
servers audited
15,290
median score
84
median tool-list cost
~2,307 tok
manipulative tool text
0
Grade distribution
A
29% · 4,429
B
36.2% · 5,542
C
29.4% · 4,499
D
5.3% · 811
F
0.1% · 9
Most common problems
68.1% — No tool declares an output schema (10,408 servers)
55.4% — Handshake + tool listing slower than 1.5 s (8,466 servers)
46.3% — Tools removed or schemas changed in 30 days (7,077 servers)
42.9% — Tools carry no read-only/destructive hints (6,556 servers)
38.7% — Parameters with no description (5,922 servers)
21.3% — Negotiates a pre-2025-06-18 protocol (3,251 servers)
16% — Several tools share one description (2,439 servers)
11.7% — State-changing tools not marked destructive (1,783 servers)
11.3% — More than 40 tools on one server (1,731 servers)
9.9% — Tool list costs agents 20k+ tokens (or top 10%) (1,520 servers)
5.8% — Under 99% uptime in 30 days (893 servers)
5.5% — Individual tool definitions over ~1,200 tokens (847 servers)
3.1% — Tool definitions require sign-in to read (471 servers)
2.3% — Tool descriptions under 20 characters (355 servers)
Tool poisoning and safety
Every tool name, description and parameter description is scanned for text aimed at the model rather than the user: invisible Unicode tag characters, bidirectional overrides, terminal escapes, instruction overrides, concealment from the user, requests to read credential or MCP config files, conversation exfiltration, cross-tool shadowing and tool-preference manipulation. Rules were checked against every hit on the live corpus to keep false positives out.
0 servers with manipulative tool text (score capped at F).
9 that steer models toward themselves ("always use this tool", "do not use web search").
28 that run arbitrary code or commands supplied by the model.
Each server's own page lists its findings with the exact text. Check one before installing at https://glimind.com/check.
Glimind audits every reachable MCP server it can find — 15,290 as of 2026-10-17 — for how well it works with AI agents. The median server scores 84/100. 29% earn an A. Loading a typical server's tool list costs an agent about 2,307 tokens before any work (the top 10% cost 13,993+). A scan of every tool definition for tool-poisoning patterns found 0 servers with manipulative text, 9 that tell models to avoid alternatives, and 28 that run arbitrary code.
How common is MCP tool poisoning?
Across 15,290 reachable servers, 0 carry hidden characters, instruction overrides, concealment, credential-file requests, conversation exfiltration or cross-tool shadowing in their tool definitions. Softer steering is more common: 9 servers tell the model to always use them or to avoid web search and other tools.
How many tokens do MCP tool definitions cost?
Median 2,307 tokens per server, 13,993 at the 90th percentile and 32,056 at the 99th. Many agents load every connected server's definitions into every request.
How is the score calculated?
Static checks of each server's advertised tool list (schemas, descriptions, safety annotations, tool-poisoning patterns, name portability, size) plus observed protocol version, uptime, latency and contract changes. No tool is ever called. Weights: schema 15, descriptions 20, safety 15, token cost 15, compatibility 15, protocol 5, reliability 10, stability 5.
Data: https://glimind.com/v1/readiness (JSON, CC-BY 4.0 — cite "Glimind"). One server per publisher in rankings. Servers are re-audited every few hours.