--- title: Ask HN: What Are You Working On? (July 2026) | daily.dev description: A security engineer built an automated scoring system for MCP (Model Context Protocol) servers to evaluate their suitability for enterprise use. The system... canonical: https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ask HN: What Are You Working On? (July 2026) | daily.dev og:description: A security engineer built an automated scoring system for MCP (Model Context Protocol) servers to evaluate their suitability for enterprise use. The system... og:url: https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw og:image: https://api.daily.dev/og/posts/4OOUt57Sw.png og:image:alt: Ask HN: What Are You Working On? (July 2026) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ask HN: What Are You Working On? (July 2026) **[Hacker News](https://daily.dev/sources/hn)** · 1 min read · 1 upvotes · 0 comments ## Summary A security engineer built an automated scoring system for MCP (Model Context Protocol) servers to evaluate their suitability for enterprise use. The system assesses 29 criteria including runtime guardrails, SAST scans, and trust models. Key findings: 1 in 10 MCP servers scores below 40/100, 18% of popular servers (1000+ GitHub stars) have security issues, and 184 servers have changed tool definitions post-publication — a potential 'rug pull' attack vector. The tool is free to browse, with API access available for automated workflows. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many MCP servers have security issues even among popular ones with lots of GitHub stars? About 18% of popular MCP servers with 1000+ GitHub stars contain one or more security issues, based on scoring against 29 criteria covering runtime guardrails, SAST scans, and transport and trust models. Separately, roughly 1 in 10 MCP servers scores 40 out of 100 or below, indicating it is largely unusable from a security standpoint. _Teams vetting MCP servers before enterprise rollout can follow security findings like these on daily.dev._ ### What is a rug pull attack in the context of MCP servers? A rug pull in the MCP context refers to a server changing its tool definitions after publication, potentially altering behavior or permissions after developers have already integrated and trusted it. Tracking of the official MCP registry found 184 servers to date have changed their tool definitions post-publication, which may signal this kind of attack. _Anyone integrating third-party MCP servers can track emerging supply-chain risks like rug pulls on daily.dev._ ## Similar posts on daily.dev - [A Proposed MCP Server Security Evaluation Framework](https://daily.dev/posts/a-proposed-mcp-server-security-evaluation-framework-73btp3tpe) · Liran Tal · 1 upvotes · 0 comments - [Guide to the OWASP MCP Top 10](https://daily.dev/posts/guide-to-the-owasp-mcp-top-10-crlkplzyp) · Nordic APIs · 1 upvotes · 0 comments - [What CISOs need to know about new tools for securing MCP servers](https://daily.dev/posts/what-cisos-need-to-know-about-new-tools-for-securing-mcp-servers-5z1ny9azn) · CSO Online · 0 upvotes · 0 comments - [7 MCP Servers to Evaluate in 2026: Features and Use Cases](https://daily.dev/posts/7-mcp-servers-to-evaluate-in-2026-features-and-use-cases-bp4clnfys) · Syncfusion · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp) [View this post on daily.dev](https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ask HN: What Are You Working On? (July 2026)","url":"https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw"},"datePublished":"2026-07-12T22:40:11.547Z","dateModified":"2026-09-14T06:50:12.121Z","description":"A security engineer built an automated scoring system for MCP (Model Context Protocol) servers to evaluate their suitability for enterprise use. The system...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,mcp","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Ask HN: What Are You Working On? (July 2026)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ask-hn-what-are-you-working-on-july-2026--4oout57sw#faq","mainEntity":[{"@type":"Question","name":"How many MCP servers have security issues even among popular ones with lots of GitHub stars?","acceptedAnswer":{"@type":"Answer","text":"About 18% of popular MCP servers with 1000+ GitHub stars contain one or more security issues, based on scoring against 29 criteria covering runtime guardrails, SAST scans, and transport and trust models. Separately, roughly 1 in 10 MCP servers scores 40 out of 100 or below, indicating it is largely unusable from a security standpoint. Teams vetting MCP servers before enterprise rollout can follow security findings like these on daily.dev."}},{"@type":"Question","name":"What is a rug pull attack in the context of MCP servers?","acceptedAnswer":{"@type":"Answer","text":"A rug pull in the MCP context refers to a server changing its tool definitions after publication, potentially altering behavior or permissions after developers have already integrated and trusted it. Tracking of the official MCP registry found 184 servers to date have changed their tool definitions post-publication, which may signal this kind of attack. Anyone integrating third-party MCP servers can track emerging supply-chain risks like rug pulls on daily.dev."}}]} ```