What 25,413 AI agent add-ons actually do.

Every skill, MCP server and plugin indexed from 7 registries is run in a honeypot with planted credentials and a recording proxy, then scored. These are the live totals across current verdicts; each one links to the packages behind it. Generated 2026-11-06 05:39 UTC; the crawler updates them every two hours. Method: /scenarios. Raw: /api/v1/stats.

Scored
25,413
19,546 with a honeypot trace (76.9%)
Verified
16,072
63.2%
Caution
9,337
36.7%
Blocked
4
0.02%

What the honeypot saw

  1. 10
    0.05% of 19,546
    read a credential path in the honeypot

    0 read SSH keys, cloud or GitHub credentials; the rest read a tool's own auth file (npm, git), which the engine no longer charges unless the run also phoned home.

  2. 8
    0.04% of 19,546
    contacted a host they never declared

    0 put a planted decoy credential on the wire: proven exfiltration.

  3. 0
    0.00% of 19,546
    wrote to the agent's instruction or memory files

    0 shadowed another server's tool.

  4. 350
    1.4% of 25,413
    carry instructions hidden from the reader

    Invisible Unicode, hidden HTML, collapsed blocks, alt text, off-screen text, imperative comments. 1 MCP servers ship a poisoned tool description. 1,808 more mention injection text in documentation, listed but not scored.

  5. 2
    0.01% of 25,413
    send the reader to a committed installer

    The Agent Lure Stealer shape: a README that walks past SmartScreen and a ZIP or launcher in the repository. Blocked before any code runs.

Repositories posing as agent tools

68

live on GitHub right now: 17 installer lure, 51 agent lure stealer. Found by a search every two hours; takedowns drop off automatically. List · JSON

Public repositories scanned

1,691

0 with a real credential value committed next to an agent config; 601 with hidden-instruction findings in instruction files. Scan yours

What a server costs the agent

2,952 tok

median prompt context an MCP server's tool list adds on every turn across 8 servers measured; the largest adds 9,886. Median handshake 471 ms. Benchmarks

By registry

RegistryScored packagesBrowse
ClawHub9,950leaderboard
PyPI9,765leaderboard
npm4,654leaderboard
skills.sh451leaderboard
Claude Code plugins314leaderboard
Docker MCP Catalog227leaderboard
Glama52leaderboard

How to read these numbers

"Scored" counts the current verdict of each package's latest version on a public registry. "With a honeypot trace" means the package was actually run; the rest have static verdicts (registries with no runnable bundle, or packages whose install step produced nothing to run). Behavior rows count packages, not events. Static false positives happen and are corrected publicly: the engine changelog records every scoring change and the verdicts move with it. To cite a figure, link this page; to reproduce one, the verdict pages carry the findings and traces, and /api/v1/threats and /api/v1/campaigns carry the incident and campaign lists.