MCPZoo: Comprehensive MCP Server Dataset
- MCPZoo is a large-scale research dataset offering unified metadata and runnable MCP servers aggregated from multiple public sources.
- It employs automated agents and multi-stage repair processes to validate server deployment and ensure dynamic, protocol-level interaction.
- The infrastructure supports reproducible empirical research, facilitating benchmarking, security analysis, and ecosystem measurement across MCP-based systems.
MCPZoo is the name used for large-scale research datasets and access infrastructures built around Model Context Protocol (MCP) servers. In the 2025 formulation, it was introduced as the largest and most comprehensive dataset of MCP servers collected from multiple public sources, comprising 90,146 servers and including 14,206 servers verified as runnable and interactable. A later runtime-focused work used the same name for the largest collection of MCP servers for dynamic analysis to date, reporting 64,611 unique MCP servers out of 113,927 valid entries and more than 37,288 supporting dynamic analysis. Across these usages, MCPZoo serves as empirical infrastructure for benchmarking, security analysis, and ecosystem measurement in MCP-based agent systems (Wu et al., 17 Dec 2025, Chen et al., 13 Jul 2026).
1. Concept and scope
MCPZoo emerged from a specific methodological gap in MCP research: empirical work on MCP had been hindered by the lack of large-scale, accessible, and runnable server datasets. The 2025 MCPZoo paper framed the problem in terms of runnability and realistic interaction, arguing that prior studies were constrained by small, manually curated datasets that were difficult to reproduce or generalize. The 2026 runtime study extended that concern from runnable access to ecosystem-scale dynamic analysis and scanner evaluation (Wu et al., 17 Dec 2025, Chen et al., 13 Jul 2026).
A concise comparison of the two principal MCPZoo usages is useful because the name denotes closely related, but not identical, infrastructures.
| MCPZoo usage | Reported scale | Primary emphasis |
|---|---|---|
| MCPZoo dataset for AI agent research | 90,146 servers; 14,206 verified as runnable and interactable | Unified metadata, runnable access, realistic experimentation |
| Runtime MCPZoo for dynamic analysis | 64,611 unique servers out of 113,927 valid entries; more than 37,288 support dynamic analysis | Automated build/repair, protocol-valid runtime interaction, scanner reliability |
The broader significance of MCPZoo is tied to the rapid growth of MCP itself. Contemporary measurement studies reported a fragmented and noisy ecosystem: one study aggregated 17,630 raw entries over 14 days and analyzed 8,401 valid projects, concluding that more than half of listed projects were invalid or low-value (Guo et al., 29 Sep 2025). Another study examined 2,562 real-world MCP applications through static analysis and emphasized the security implications of broad resource access and absent privilege isolation (Li et al., 5 Jul 2025). In that context, MCPZoo functions as infrastructure for moving from small-sample inspection to large-sample, reproducible MCP measurement.
2. Dataset construction and runnability
The 2025 MCPZoo dataset was assembled from six major public platforms: MCP World, MCP Store, MCP Servers Repository, AIbase MCP, Mcp.so, and Pulse MCP. Collection was organized around unified metadata extraction, source-code download and organization, and semantic deduplication. The deduplication procedure normalized URLs and metadata, vectorized textual content, clustered similar projects, retained only a single representative for highly similar or forked projects, and preserved provenance information (Wu et al., 17 Dec 2025).
Its defining technical contribution was to “make the zoo alive.” An automated agent analyzed each project’s codebase and dependencies to generate a Docker image with appropriate runtime configuration. If builds failed, the system attempted automatic repair and rebuild up to a retry limit. Servers were marked “alive” only if they passed both execution validation and protocol-level validation, including the ability to return tool lists and basic MCP endpoint responses. At the time of publication, 14,206 servers had been deployed and verified as runnable (Wu et al., 17 Dec 2025).
The 2025 release also quantified source composition. MCP World contributed 31,048 collected entries, MCP Store 25,695, MCP Repository 14,341, AIbase MCP 11,120, Mcp.so 6,772, and Pulse MCP 1,170, for a total of 90,146. The paper presented this aggregation as a diversity mechanism, combining independently curated directories from different communities and platforms rather than relying on a single market index (Wu et al., 17 Dec 2025).
3. Runtime reconstruction and dynamic MCPZoo
The 2026 runtime MCPZoo reframed the construction problem as one of transforming in-the-wild static repositories into dynamic services. It introduced a fully automated, multi-agent framework comprising a Generation Agent, a Verification Agent, and a Diagnosis Agent. The Generation Agent created deployment configurations, primarily Dockerfiles; the Verification Agent launched servers in isolated containers and checked protocol-level behavior; and the Diagnosis Agent analyzed failures and iteratively refined deployments until success or a retry limit was reached (Chen et al., 13 Jul 2026).
Three techniques were emphasized in that framework. First, environment inference summarized deployment patterns from successful builds and reused them on new or broken servers. Second, log summarization extracted concise, high-signal error contexts for LLM processing. Third, feedback-driven repair converted observed failures into concrete adjustments rather than relying on undirected trial and error. This construction process was paired with containerization, Kubernetes-based management, and abstraction over stdio, Server-Sent Events, and Streamable HTTP through network proxies and gateways, so that heterogeneous MCP interaction mechanisms could be exposed through a unified interface (Chen et al., 13 Jul 2026).
The runtime corpus was substantially larger than the original release in raw terms. The study reported 156,842 MCP server entries collected from 10 markets, 113,927 valid MCP servers after filtering, 64,611 unique projects after deduplication, and 37,288 unique servers that were dynamically deployable and therefore analyzable at runtime. Human validation further reported that 100% of sampled successful automated deployments were true MCP servers, diagnosis coverage of failure cases exceeded 93%, and protocol-level spot checks achieved an agreement rate of about 98% (Chen et al., 13 Jul 2026).
4. Metadata, interfaces, and access model
A central design goal of MCPZoo was to eliminate the manual deployment burden that had constrained prior MCP experimentation. The 2025 release therefore defined a unified metadata schema across all entries. The documented fields were serverName, description, source, creator, and overview. These fields supported programmatic filtering, exploration, and offline analysis across the full collection (Wu et al., 17 Dec 2025).
Access was organized through multiple interfaces. The 2025 paper specified a public website at https://security.fudan.edu.cn/zoo, metadata download for offline analysis, and remote live-server access through a unified remote access configuration. The web portal exposed interfaces for a trial set of 15 live MCP servers, while access to the full set of 14,206 interactable servers was available on request for research purposes and subject to responsible-use agreements. The stated access conditions included legal compliance, non-commercial use, no redistribution, responsible testing, and faculty endorsement for requests (Wu et al., 17 Dec 2025).
The 2026 runtime work added a public query interface oriented toward practical risk assessment: https://security.fudan.edu.cn/zoo/risk-monitor. According to that study, the interface supports inputs by source code or repository URL, tool schema, or server features, and returns matched entities, scanner reports from all 8 tools, cross-scanner agreement, and human validation status when available. It also distinguishes exact matching by repository from fuzzy matching by features, name, or schema (Chen et al., 13 Jul 2026).
5. Research uses and methodological role
The original MCPZoo paper positioned the dataset as infrastructure for three research directions. First, it enables realistic agent benchmarking because agents can be evaluated against a large, diverse, live suite of tools rather than synthetic or manually staged connectors. Second, it enables protocol-level security measurement at scale, including studies of prompt injection vulnerabilities, sandbox escape attempts, misconfiguration, and privilege escalation. Third, it supports ecosystem-wide measurement, such as trend analysis in MCP adoption, tool design, and implementation patterns (Wu et al., 17 Dec 2025).
This role is reinforced by surrounding MCP security literature. A static-analysis study of 2,562 real-world MCP applications proposed a taxonomy of MCP resource access spanning file, memory, network, and system resources, and found that network and system resource APIs dominated usage patterns, affecting 1,438 and 1,237 servers respectively (Li et al., 5 Jul 2025). A bidirectional static analysis framework later analyzed 15,452 MCP server repositories and, after manual review, confirmed 118 vulnerability paths in 87 servers, emphasizing that unsafe propagation often resists generic SAST without MCP-aware entrypoint recovery (Hou et al., 8 May 2026). Another end-to-end auditing framework scanned 39,884 real-world open-source MCP server repositories and reported 106 0-day vulnerabilities, all confirmed through exploit traces, with 67 CVE IDs assigned at the time of writing (Sun et al., 20 May 2026).
Remote deployment studies show why runtime corpora matter. A first measurement study on authentication security in real-world remote MCP servers identified 7,973 live remote MCP servers and found that 40.55% exposed tools without authentication; among 119 testable OAuth-enabled servers, every server exhibited at least one authentication flaw (Zhou et al., 21 May 2026). For agent-side evaluation, MCP Security Bench introduced 12 MCP-specific attack classes and executed 2,000 attack instances across 10 domains and 400+ tools, arguing that MCP-specific risk must be assessed across planning, invocation, and response handling rather than at isolated API boundaries (Zhang et al., 14 Oct 2025). Together, these studies indicate the methodological niche that MCPZoo is designed to fill: reproducible access to large, heterogeneous, and, crucially, executable MCP servers.
6. Security measurement, scanner reliability, and ecosystem interpretation
The runtime MCPZoo study did not merely provide more servers; it also challenged how MCP security claims are produced. Using its dynamic corpus, the study evaluated eight widely used MCP security scanners and found that 96.89% of interactable MCP servers were flagged as risky by at least one scanner. However, manual validation showed that only 45.53% of sampled alerts were true positives, recall on true CVE-linked vulnerabilities was 24.17%, and the average pairwise Jaccard similarity among scanners was only 15.66%. The study concluded that current MCP security scanners are not yet reliable enough to support ecosystem-level security claims (Chen et al., 13 Jul 2026).
That same study also produced structural findings about the ecosystem represented inside MCPZoo. It reported that about 28% of unique MCP servers were forks, mirrors, or template-based clones; 78.6% of MCP projects lacked a Dockerfile; only 19.6% of even well-documented projects deployed successfully using their native artifacts; and the automated build/repair pipeline raised deployment success to 54%+. In capability terms, 37.66% of all tools provided high-risk capabilities such as command execution, local file modification, or outbound data transfer, while 56% were classified as medium-risk. It also noted strong cross-market redundancy, with up to 90% overlap in some market pairs (Chen et al., 13 Jul 2026).
These findings are important for interpreting raw MCPZoo counts. Large catalog totals do not necessarily imply large numbers of distinct, well-maintained, securely deployable systems. Earlier ecosystem measurement likewise reported fragmentation and redundancy, with 41.9% of projects appearing in multiple markets but only 6.9% indexed in four or more markets, alongside substantial abandonment and dependency monocultures (Guo et al., 29 Sep 2025). A plausible implication is that MCPZoo should be understood not only as a corpus of servers, but also as an instrument for disentangling nominal ecosystem scale from operational, security-relevant scale.
7. Position in the MCP research landscape
MCPZoo has been repeatedly compared, explicitly or implicitly, to infrastructure projects such as AndroZoo. The 2025 paper stated that it was inspired by AndroZoo for Android apps, and the 2026 runtime work extended that analogy from collection to live, protocol-valid execution (Wu et al., 17 Dec 2025, Chen et al., 13 Jul 2026). In both cases, the objective was not merely archival completeness, but a standardized substrate for reproducible empirical research.
Its significance is therefore partly infrastructural and partly epistemic. Infrastructurally, MCPZoo lowers the barrier to large-scale experimentation by providing unified metadata, deduplicated collections, deployment automation, and remote interaction. Epistemically, it changes what can be claimed about MCP: static code analysis, runtime exploit confirmation, authentication measurement, agent attack benchmarking, and scanner benchmarking can all be conducted against broader and more realistic server populations than previously available. This suggests that “MCPZoo” has come to denote a family of benchmark resources for MCP ecosystems rather than a single immutable release (Wu et al., 17 Dec 2025, Chen et al., 13 Jul 2026).
Open research questions remain aligned with those already highlighted in adjacent MCP work: how to design privilege management that balances MCP flexibility with security constraints, whether permission models should be dynamic and context-aware, how runtime and static analysis should be integrated, and how trust assessment can be automated for large plugin or server markets (Li et al., 5 Jul 2025). Within that agenda, MCPZoo occupies a foundational role as shared empirical infrastructure for studying MCP-based security, interoperability, and ecosystem evolution.