Software Supply Chain Hygiene of Model Context Protocol Servers: An Empirical Study

The Model Context Protocol (MCP) has, within roughly eighteen months of its release, become the dominant mechanism by which large language model agents discover and invoke external tools. Public registries already list tens of thousands of MCP servers, and a growing body of security research has begun to characterize the protocol-level risks this introduces, including authentication gaps, prompt-injection-driven tool invocation, and taint-style code execution vulnerabilities in server implementations. Comparatively little attention has been paid to a more prosaic question: as software artifacts distributed through ordinary package registries, do MCP servers exhibit the basic software supply chain hygiene that the broader open-source ecosystem has spent the last several years build-ing tooling to measure? We address this gap with an empirical study of 300 published MCP servers compared against a matched baseline of 300 general-purpose npm and PyPI packages, evaluating both populations along four dimensions: software bill of materials (SBOM) completeness, OpenSSF Scorecard security posture, known-vulnerability density in the dependency tree, and SLSA provenance adoption. We find that MCP servers carry substantially larger and more deeply nested dependency trees than baseline packages (median 138 vs. 15 components), exhibit significantly higher known-vulnerability density (Mann-Whitney U, p < 0.001, Cliff’s δ = 0.28), and score modestly lower on OpenSSF Scorecard, driven primarily by weaker code-review and contributor-base checks consistent with the ecosystem’s youth (median repository age 126 days vs. 2,786 days for baseline). SLSA provenance adoption is effectively absent in both populations: only 1 of 300 MCP servers and 4 of 300 baseline packages published a verifiable provenance attestation, and only one attestation in the entire 600-package sample passed cryptographic verification. We additionally surface a methodological finding with broader relevance to empirical supply-chain research: a naively constructed composite hygiene score that zero-imputes missing measurements produces a statistically significant but spurious between-group difference that disappears entirely under complete-case analysis (p= 0.68), an artifact of differential instrumentation failure rates rather than differential security posture. We discuss the implications of these findings for MCP registry governance, conclude that the protocol’s security conversation should expand to include conventional supply-chain hygiene alongside protocol-level threats, and release our complete data collection pipeline and dataset for reproducibility.