This lesson is part of Learn MCP, our free course on the Model Context Protocol, within The MCP Guide.
In this lesson you will:
- Learn where MCP servers are published, from most to least trustworthy.
- Understand what the official MCP Registry checks and what it does not.
- Practice confirming who really publishes a server.
There are a great many public MCP servers, and more appear every week. Finding one is easy. Finding one you can trust takes a method.
Key Takeaways
- Start with the official server from the vendor whose product you want to connect, found through that vendor's own docs.
- The official MCP Registry verifies who owns a server's namespace, but it does not scan server code for security problems.
- The reference servers in the official GitHub repo are learning examples, not production-ready tools.
- App galleries and directories help you discover servers, but a listing is not a security audit.
- Typosquatted names, missing source code and unclear publishers are reasons to walk away.
1. Start with the vendor's own server
The safest first stop is the company that makes the tool. If you want AI access to your payments, code or CRM, check that vendor's developer docs for an official MCP server. Many vendors now publish one. For example, GitHub publishes its own MCP server on its official GitHub account.
An official server comes from the same company that already holds your data. It usually uses that company's normal sign-in and permission model. It also gives you a clear party to contact if something goes wrong.
Reach the server's page from the vendor's own website, not from a search ad or a forum link. That one habit removes many fake-server risks.
2. Check the official MCP Registry
The official MCP Registry is "the official centralized metadata repository for publicly accessible MCP servers." It is backed by contributors including Anthropic, GitHub, PulseMCP and Microsoft. As of October 2026, it is in preview, and the docs warn that "breaking changes or data resets may occur."
You can browse it at registry.modelcontextprotocol.io, which has a search box and a "Show only latest versions" filter.
Here is what the registry does and does not do, per its docs:
| The registry does | The registry does not |
|---|---|
| Verify namespace ownership through GitHub, DNS or HTTP challenges | Scan server code for vulnerabilities |
| Store metadata that points to packages on npm, PyPI or Docker Hub | Host the server code itself |
| Let maintainers manually remove spam or malicious servers | List private servers |
| Provide a REST API for marketplaces and aggregators | Rate or rank servers |
The namespace is the useful trust signal. Server names follow a reverse DNS format such as io.github.username/server or com.example/server. The docs say this ensures "only the legitimate owner of a GitHub account or domain can publish servers under that namespace."
So a server named com.stripe/... should come from whoever controls the stripe.com domain. A server named io.github.someone/stripe-tools comes from a GitHub user named someone, not from Stripe.
For security scanning, the registry relies on the package registries and on "downstream aggregators." Our MCP Registry explainer covers listings in more detail.
3. Know what the reference servers are for
The official servers repository on GitHub holds a small set of reference servers. As of October 2026, they are Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time. Older reference servers have been archived to a separate repository.
The README is clear about their purpose. They are "reference implementations to demonstrate MCP features and SDK usage," meant as educational examples rather than "production-ready solutions."
That makes them great for practice, like the filesystem server in Lesson 6. It does not make them a fit for business data without your own review.
4. Use app galleries and directories for discovery only
Many AI apps now have their own catalog:
- Anthropic Directory. Claude Code's managed MCP docs say Anthropic "reviews connectors against its listing criteria before adding them to the Anthropic Directory, but doesn't security-audit or manage any MCP server."
- VS Code gallery. The VS Code MCP docs describe an MCP server gallery in preview, found by searching
@mcpin the Extensions view. - Cursor Marketplace. Cursor's docs point to the Cursor Marketplace for official plugins and to cursor.directory for community servers. They add: "Only install MCP servers from trusted developers and repositories."
Independent directories collect thousands more. They are useful for discovery, but quality and checks vary. Compare them in our list of MCP directories and registries.
Treat every listing as a lead, then confirm the publisher yourself. Anthropic's custom connectors guide is direct: custom connectors "aren't verified by Anthropic," so connect only to servers you trust.
5. Watch for red flags
Fake and careless servers share some patterns. Walk away, or dig deeper, if you see any of these:
- A lookalike name. One letter off from a real vendor, or a vendor name in a personal GitHub namespace. This is called typosquatting. See MCP supply chain risks.
- No source and no publisher. You can't tell who wrote it or find its code or docs.
- Broad permissions for a narrow job. A "weather" server that asks for your email or file system.
- An install command you can't read. The spec's security best practices show how a config can hide a harmful command next to a real package.
- Only a deprecated SSE endpoint. It may signal a server that is not maintained. See Lesson 5.
- No changelog or update history. Developers can change tool behavior without notice, as Anthropic's guide warns.
Try it
Pick one tool your business uses, such as your CRM, payments or code host. Then:
- Find the vendor's page. Go to the vendor's own website and search its developer docs for "MCP." Write down the server's URL or package name.
- Look it up in the registry. Search the registry at
registry.modelcontextprotocol.iofor the vendor's name. Note the server's full name and namespace. - Match the namespace. Does the namespace match the vendor's domain or official GitHub account? If the registry shows a server under a personal namespace, it is not the vendor's.
- Compare install details. Check that the package name or remote URL in the registry matches the vendor's docs exactly.
- Note what is missing. If the vendor has no official server, write down which third-party options exist and who publishes each.
Keep your notes. Lesson 9 shows how to read a server's tools and permissions before you connect it.
Recap
- Look first for the vendor's official server, reached from the vendor's own site.
- The MCP Registry confirms who owns a namespace and points to packages, but it does not audit code.
- Reference servers are for learning, not production use.
- App galleries and directories help discovery; you still confirm the publisher.
- Lookalike names, unclear publishers and over-broad permissions are red flags.
For a broader checklist, see how to choose MCP servers. All lessons are on the Learn MCP course page.
Course navigation
Previous lesson: Lesson 7: Choose an MCP Client.
Next lesson: Lesson 9: Read a Server Before You Trust It.
Back to the Learn MCP course outline.
Frequently asked questions
Is a server in the official MCP Registry safe?
Not automatically. The registry verifies that the publisher owns the namespace, such as a GitHub account or domain. It leaves security scanning to package registries and downstream aggregators. You still need to review the server.
What does "io.github.username" mean in a server name?
It is a reverse DNS namespace. It means the server was published by that GitHub account. A name like com.example/server means the publisher proved control of the example.com domain.
Can I put my company's private server in the official registry?
No. The registry docs say it does not support private servers, such as ones on a private network or private package registry. They recommend hosting your own private registry instead.
Are the official reference servers ready for business use?
The repository describes them as reference implementations for learning, not production-ready solutions. Use them to practice, and pick a maintained, vendor-supported server for real business data.
Does a listing in the Anthropic Directory mean Anthropic audited the server?
No. Claude Code's docs say Anthropic reviews connectors against its listing criteria, but doesn't security-audit or manage any MCP server. A listing is a starting point, not a guarantee.
