This site presents a single, deliberately limited measurement pass over 67 npm-packaged MCP servers. The question it asks is narrow: what does a server do at startup, before any tool is invoked? Because no tool is ever called, the results say nothing about whether tools work as advertised. The authors state plainly that the work is not calibration-backed and not a ranking, positioning it as published method and published evidence rather than a product review.
The headline findings are concrete. Seven of the 67 servers attempted to reach a website their own README does not name, and each is recorded with the requested name and the README line that omits it. The test environment had no route off the host, so every name resolved to loopback and no connection completed. Separately, 24 servers offered at least one tool their README does not name, out of 1,143 tools offered in total and none called.
The authors attach an important caveat to the tool-naming figure: the rule reads only the README shipped inside the package, so a server that documents its tools in a companion reference file will show every tool as unnamed. Ten of the affected servers have READMEs under three kilobytes, and a large count reflects the rule as much as the package. Two servers triggered both findings, and the remaining 38 had nothing detected, which the site explicitly says is not the same as a clean result.
This material is aimed at developers, security reviewers, and platform teams assessing MCP serv
Comments & Ratings
0No comments yet. Be the first to review.