Early AccessEvery agent is free to connect — no card, no checkout. Paid agents are coming.
Anyone can publish an MCP server, and most public directories list thousands of them with no human ever looking. FindAgent takes the opposite approach: every agent passes an automated security scan and a human review before it can go live. This report is an honest look at what that review catches — the exact checks, and anonymized, aggregate results from our own pipeline. Every number is computed from our real review data or it isn’t shown; nothing here is estimated or inflated.
Across 183 agents FindAgent scanned and reviewed (external, unreviewed directory listings excluded), 183 passed the automated scan clean and 0 were flagged by the automated scan with a high or critical finding for a person to review. (The scan verdict is one input — a clean scan is necessary but not sufficient, and a person makes the final publish call either way.)
| What the scan caught | Agents |
|---|---|
Embedded credential An API key, token, or private key pasted directly into a manifest instead of a bound credential slot. | 0 |
Prompt-injection / exfiltration text Instruction-shaped text that tries to override a model or exfiltrate a conversation or credentials. | 0 |
Unbound or unsafe tool target A tool action that would send a credential to a host it is not bound to, or targets a private / internal / cleartext endpoint. | 22 |
Obfuscated / encoded payload Large base64 / hex / unicode-escape blobs or decode primitives used to hide content. | 0 |
Hidden-Unicode smuggling Invisible tag, bidirectional, zero-width, or control characters that can hide instructions from a human reviewer. | 0 |
A cell reading <10 means the real count fell below our anonymity floor and was suppressed — never rounded or guessed. A count is shown only when it is zero or at least 10 agents.
Before an agent can publish, an automated scan runs over its entire definition. Every check below is real and runs on our servers — a high or critical finding fails the scan and holds the agent back for a human look.
Scans every text field for a leaked API key, token, or private key (AWS, GitHub, OpenAI, Anthropic, Stripe, Google, Slack, JWTs, PEM keys). A real embedded secret fails the scan — credentials belong in a bound slot, never inline.
Every tool action is checked against the credential it uses: the key may only be sent to the exact hosts that credential declares. A target the key can’t reach, a private / internal / loopback address, or a cleartext (non-HTTPS) endpoint is flagged.
Flags instruction-shaped text that tries to override a model or exfiltrate a conversation, credentials, or tokens. For a recipe whose prompt runs verbatim in your own model, an exfiltration pattern fails the scan.
Catches large base64 / hex-escape blobs and decode primitives, plus invisible tag, bidirectional, zero-width, and control characters that can smuggle hidden instructions past a human reviewer.
Validates the manifest schema, size, and slug, and rejects a duplicate of an existing agent. Malformed or oversized manifests are held for a human look rather than waved through.
How the cohort is defined, how the numbers are produced, and how we keep them anonymous.
Every agent’s page shows plain-language security facts drawn from its own definition — whether it ships code, the exact hosts your keys can reach, and which tools can change or delete data. The security model spells out each rule and what it does not cover.
Honest boundaries build more trust than a bigger-looking number.
Comparing marketplaces? See FindAgent vs other MCP marketplaces
Anyone can publish an MCP server, and most public directories list thousands of them with no human ever looking. FindAgent takes the opposite approach: every agent passes an automated security scan and a human review before it can go live. This report is an honest look at what that review catches — the exact checks, and anonymized, aggregate results from our own pipeline. Every number is computed from our real review data or it isn’t shown; nothing here is estimated or inflated.
Across 183 agents FindAgent scanned and reviewed (external, unreviewed directory listings excluded), 183 passed the automated scan clean and 0 were flagged with a high or critical finding for a person to review. A clean scan is necessary but not sufficient — a person makes the final publish call either way.
A cell reading <10 means the real count fell below our anonymity floor and was suppressed — never rounded or guessed. A count is shown only when it is zero or at least 10 agents.
Before an agent can publish, an automated scan runs over its entire definition. Every check below is real and runs on our servers — a high or critical finding fails the scan and holds the agent back for a human look.
Scans every text field for a leaked API key, token, or private key (AWS, GitHub, OpenAI, Anthropic, Stripe, Google, Slack, JWTs, PEM keys). A real embedded secret fails the scan — credentials belong in a bound slot, never inline.
Every tool action is checked against the credential it uses: the key may only be sent to the exact hosts that credential declares. A target the key can’t reach, a private / internal / loopback address, or a cleartext (non-HTTPS) endpoint is flagged.
Flags instruction-shaped text that tries to override a model or exfiltrate a conversation, credentials, or tokens. For a recipe whose prompt runs verbatim in your own model, an exfiltration pattern fails the scan.
Catches large base64 / hex-escape blobs and decode primitives, plus invisible tag, bidirectional, zero-width, and control characters that can smuggle hidden instructions past a human reviewer.
Validates the manifest schema, size, and slug, and rejects a duplicate of an existing agent. Malformed or oversized manifests are held for a human look rather than waved through.
How the cohort is defined, how the numbers are produced, and how we keep them anonymous.
Honest boundaries build more trust than a bigger-looking number.
Comparing marketplaces? See FindAgent vs other MCP marketplaces
Before an agent can publish, an automated scan runs over its whole manifest: it looks for embedded credentials (leaked API keys, tokens, private keys), checks that every tool action can only send a credential to the hosts it declares, flags prompt-injection and exfiltration text, catches obfuscated or hidden-Unicode payloads, and validates the manifest shape. Any high or critical finding fails the scan and holds the agent back, and a person reviews every agent before it can go live.
They are real. Every figure is computed at page load from FindAgent’s actual review output — the stored scan results for agents we reviewed — behind a k-anonymity floor. A number is shown only when its group is zero or at least 10 agents; smaller groups are suppressed so no single agent or creator can be identified. Nothing is hardcoded, estimated, or inflated, and external directory listings we index but never reviewed are excluded.
No. FindAgent indexes some listings from a public MCP registry, but those are auto-ingested, unvetted, and labeled "not reviewed by FindAgent." They are excluded from every figure in this report. The cohort is only agents FindAgent actually scanned and human-reviewed, so the numbers reflect our own pipeline, not someone else’s directory.