MCP server security index · free
Leash reads the manifest of every listed MCP server and scores what it declares it can do — which tools send, delete or move money, and which declare no cap, no expiry and no way to switch them off. Then it checks your own stack, in your browser.
Your config never leaves your browser. No account.
Servers whose manifest declares at least one tool that can…
Counted from each server's own tools/list. A server can appear in several rows.
33,489
MCP servers from 23,348 publishers; every public endpoint re-checked weekly
10,111
declare tools that send, delete or move money — from 6,740 publishers
1,737
declare tools that move money
4,403
declare tools that bring in outside content — web pages, search, email
12,965
mark none of their tools with MCP safety hints
Pricing
Everything on screen is free. The self-serve report is a one-time $49 at launch price — no account, no subscription. Nothing here needs a quote, a call or a reply from us.
$0 forever
Everything you need to decide what to connect.
$49 one-time
The audit deliverable, generated for your own stack or server in your browser — ready to hand to a security reviewer.
$250 a month, or $2,500 a year — any number of engineers, any number of machines. Charging per seat would price a team out of guarding the laptop nobody thought needed it, which is the one the incident comes through.
The shared policy, the receipts and the alerts live in storage you control. Leash never receives what your agents did, and you create no account.
See Guard TeamStack blast radius
Directories and most scanners score servers one at a time. But an agent connects to all of them at once. When one server brings outside content in — a web page, an issue, an email — and another can send, delete or move money, an instruction planted in that content has a route from the first to the second.
The stack check draws that route for your config: which of your servers let content in, which tools it could reach, and three ways to narrow it. The few scanners that look across servers need your config uploaded or a tool installed; this runs in your browser against the public index, so it works on configs you would never upload.
Find your blast radiusIllustration
Content comes in
fetch_url
read_email
What it could reach
create_refund
delete_page
send_message
Leash Guard · free, MIT
Knowing your blast radius does not shrink it. Guard sits between your client and any MCP server and puts every call through a limit you set: reads go straight through, writes and sends get a cap, and anything that deletes or moves money waits for your yes. Every decision is appended to a hash-chained receipt you can verify afterwards.
It is a local proxy, not a service. Your client starts Guard, Guard starts the server, and the proxy talks to nothing but the
server it is in front of. One file, no dependencies, no account. uninstall puts every config back exactly as it was.
One command
npx @leashkit/guard installWhat it applies until you say otherwise
| reads | no limit | |
|---|---|---|
| writes | 50 an hour | |
| sends | 10 an hour | |
| deletes | 5 an hour | asks you first |
| payments | 3 an hour | asks you first |
Leash Grant · free
If your product's agent acts on your customers' accounts, send each customer to a consent page that says in plain words what the agent is asking to do. They can drop a line, lower a cap, shorten the time or decline. You get back a signed grant, and your agent checks every action against it.
The customer keeps a private page for that grant. It shows what the agent did, asks them before anything they marked “ask me each time”, and has the switch that turns the agent off. They create no account, and Leash is not told who they are.
Leash is not in the path of your agent's calls: a grant holds an agent where your code checks it.
What your customer reads
Waiting for your answer
| Delete from crm.contacts | Approve once | Refuse |
|---|
What the agent did
| Allowed | read from crm.contacts. | |
|---|---|---|
| Allowed | send through email.outbox. | |
| Blocked | send through email.outbox, because the limit had been reached. | |
| Blocked | move money through billing.refunds, because that was never allowed. | |
An example. The demo shows the real page.
Permission changelog
You connected a server last month. This week its manifest declares a delete tool. Nobody tells you — so the index does: every re-crawl is compared with the last published record, and the difference is dated and published. 5,759 changes recorded so far, 1,335 adding send, delete or payment tools.
Manifest retrieved 2026-10-28, then 2026-11-08
Reclassified act from writes to destructive
Reclassified claim_world from writes to destructive
Reclassified credit_gift from writes to destructive
Reclassified draw_self from writes to destructive
Manifest retrieved 2026-10-28, then 2026-11-08
Now declares hl_liquidations destructive, onchain_ens sends, ai_image writes, ai_prompt_injection writes, ai_transcribe writes, ai_translate writes and 55 more
Manifest retrieved 2026-10-28, then 2026-11-08
Now declares chat_moderate destructive, chat_register_llm writes, chat_participants reads, chat_wait_events reads
Reclassified chat_messages from sends to reads
How it works
Servers come from the official MCP registry. Public endpoints are asked directly; servers that ship only as an npm, PyPI or container package are run in isolation. A short list of vendors’ published servers is read the same way.
Each server is asked for its tools/list — read-only, three protocol methods, nothing that acts.
Every tool is read as read, write, send, delete or move money, and each reading records its basis.
Exposure grows with irreversible, uncapped, unrevocable capability — with diminishing returns, so size alone cannot max it out.
Every week, again. Changes are archived, never written over, and published in the changelog.
The full method is in the methodology.
How it compares
Categories, not vendors — tools inside each group differ, and several do things Leash does not, like scanning source code or blocking calls at runtime. Use a gateway for enforcement; use Leash to decide what to enforce.
| Capability | Leash | MCP directories | MCP security scanners | MCP gateways |
|---|---|---|---|---|
| Scores what a server can do to your account | Yes | Some; often docs or code quality | Per scan | No |
| Separates tools that send or move money | Yes | No | Rarely | No |
| Checks your own config without uploading it | Yes | No | Uploads, or install a CLI | No |
| Cross-server blast radius for your stack | Yes | No | Some, after upload | No |
| Public, dated record of permission changes | Yes | No | No | No |
| Blocks calls at runtime | No | No | No | Yes |
| Free to use | Yes | Yes | Free tier | Varies |
The index
FAQ
A number from 0 to 100 describing what a server’s own tools/list manifest declares it can do: how many tools write, send, delete or move money, and whether each declares a cap, an expiry, a way to switch it off and an audit trail. It grows with irreversible, ungoverned capability, with diminishing returns so a large server cannot max it out on size alone.
No. The score describes capability as declared in the manifest, not how the product behaves. A payments server should be able to move money — the score tells you it can, so you can decide what limits to put around it. A product may also provide controls outside MCP that a manifest cannot express.
No. The check runs in your browser against a copy of the index that ships with the page. The page’s security policy blocks every network request and it has no form, so it has no way to send your config anywhere. API keys in the config are never displayed.
The route an injected instruction could take through your stack. If one connected server declares tools that bring outside content in (web pages, search results, email) and another declares tools that send, delete or move money, a hidden instruction in that content has a path to those tools. The stack check lists both sides for your config.
No. Leash checks permissions: what each server declares its tools can do, and whether those declarations carry any limit. It does not scan a server’s code, test it for exploits, or detect instructions hidden in tool descriptions — use a security scanner for that. What Leash gives you is the other half: which tools to limit, and the limit to set. We are building Leash Guard, a free local proxy that enforces those limits in front of any MCP server, next.
Scanners analyse one server or one machine at a time, usually for tool poisoning, prompt injection or vulnerable code, and many upload what they scan. Leash is a public index of what servers declare they can do, a config check that never leaves your browser, and a dated history of permission changes. They answer different questions and work well together.
Every server with a public endpoint is asked again weekly. A server read from a package is read once per published version, and again when a new version appears. If a manifest changed, the previous record is archived on the server’s page and the difference is published in the permission changelog and its Atom feed.
No. No one can pay for a score, a ranking, a listing or a removal, and buying a report does not change any listing. Maintainers can submit their own manifest and prove they maintain the server; a correction is added to the record, never written over it.
The index, the stack check and the permission changelog are free. The self-serve stack report is $49, one-time, with no account: a dated report for your own stack or server, generated in your browser, refundable within 14 days. That price is the whole amount — any sales tax or VAT is already inside it.
No. The hand-reviewed permission audit is no longer offered. Everything here is self-serve: the stack report gives the same reading as a dated document, generated in your browser, for servers in the index and for a tools/list response you paste for your own server.
Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed and Codex — any JSON, JSONC or Codex TOML config with an mcpServers, servers, context_servers or mcp_servers block. Remote servers are matched by address, local ones by npm package or container image.
Paste your config. Thirty seconds, nothing uploaded, nothing to sign up for.