What We Scanned
The 7 top MCP servers (by stars) plus the Anthropic skills repo were cloned and run through the Gardu static scanner. We apply Hexbane rule philosophy across families HB101–HB701: hidden content, injection, secrets, execution & exfiltration, MCP config, and tool manifest.
Limits: This is a pattern/structure scanner that reads text — it does not execute code or follow URLs. PASS = "nothing known found", not "safe". A clean scan means no known bad patterns were detected; it does not guarantee the code is secure.
| Repository | Files Scanned | Findings | Verdict |
|---|
Security Findings
Notable findings from the scan, grouped by repository.
No notable findings recorded yet. Scan status: pending.
Top Public MCP Servers
| # | Name | Category | Stars | Language | Last Push | Scan |
|---|
Top Public Skills
| # | Name | Category | Stars | Language | Last Push |
|---|
The State
Data & Reproduce
Get the Raw Data
All data is open. Download the JSON files or browse the repository:
Reproduce the Scan
Run the scan yourself on any repository:
npx -y hexbane scan <path>
Source
GitHub API data as of . Scan performed by Gardu/Hexbane static scanner.