Title: Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers Show Chinese title

Title: 初看模型上下文协议（MCP）：研究MCP服务器的安全性和可维护性

Abstract: Although Foundation Models (FMs), such as GPT-4, are increasingly used in domains like finance and software engineering, reliance on textual interfaces limits these models' real-world interaction. To address this, FM providers introduced tool calling-triggering a proliferation of frameworks with distinct tool interfaces. In late 2024, Anthropic introduced the Model Context Protocol (MCP) to standardize this tool ecosystem, which has become the de facto standard with over eight million weekly SDK downloads. Despite its adoption, MCP's AI-driven, non-deterministic control flow introduces new risks to sustainability, security, and maintainability, warranting closer examination. Towards this end, we present the first large-scale empirical study of MCP servers. Using state-of-the-art health metrics and a hybrid analysis pipeline, combining a general-purpose static analysis tool with an MCP-specific scanner, we evaluate 1,899 open-source MCP servers to assess their health, security, and maintainability. Despite MCP servers demonstrating strong health metrics, we identify eight distinct vulnerabilities - only three overlapping with traditional software vulnerabilities. Additionally, 7.2% of servers contain general vulnerabilities and 5.5% exhibit MCP-specific tool poisoning. Regarding maintainability, while 66% exhibit code smells, 14.4% contain nine bug patterns overlapping with traditional open-source software projects. These findings highlight the need for MCP-specific vulnerability detection techniques while reaffirming the value of traditional analysis and refactoring practices. Show Chinese abstract

Abstract: 尽管像GPT-4这样的基础模型（Foundation Models，FMs）在金融和软件工程等领域被越来越多地使用，但对文本界面的依赖限制了这些模型在现实世界中的交互能力。 为了解决这个问题，基础模型提供商引入了工具调用，这引发了大量具有不同工具界面的框架的涌现。 截至2024年底，Anthropic推出了模型上下文协议（Model Context Protocol，MCP），以标准化这一工具生态系统，该协议已成为事实上的标准，每周有超过八百万次SDK下载量。 尽管得到了采用， MCP基于人工智能的非确定性控制流为可持续性、安全性和可维护性引入了新的风险，需要进一步研究。 为此，我们进行了首个针对MCP服务器的大规模实证研究。 通过最先进的健康指标和混合分析管道，结合通用静态分析工具与特定于MCP的扫描器，我们评估了1,899个开源MCP服务器，以评估它们的健康状况、安全性以及可维护性。 尽管MCP服务器表现出强劲的健康指标，但我们识别出八个不同的漏洞——其中只有三个与传统软件漏洞重叠。 此外，7.2%的服务器包含通用漏洞，5.5%存在MCP特有的工具投毒问题。 关于可维护性方面，虽然66%的服务器表现出代码异味，但14.4%的服务器包含九种与传统开源软件项目重叠的错误模式。 这些发现强调了开发MCP特定漏洞检测技术的必要性，同时重申了传统分析和重构实践的价值。