10,335 Local-Subprocess MCP Profiles Put Risk at the Endpoint Boundary
Among 11,627 detailed profile rows, 10,335 are local subprocess entries and 10,070 use stdio. MCP security is often about what gets launched on the local machine, not only what remote API is called.
Terminology
| Term | Meaning |
|---|---|
| Public Registry | Inspected MCP candidates searchable in the public Registry |
| Profile evidence | Inspection-profile aggregates used to interpret public candidates in more depth |
| Review/action rows | Entries in WARN, NEED_REVIEW, RESTRICT, or BLOCK that require reasoned adoption review |
Lead
It is easy to imagine MCP as a remote-service problem. The inspected profile data says otherwise: most candidates are launched as local processes, creating a different security boundary from a browser extension or SaaS integration.
Key Findings
- 10,335 profiles are local subprocess entries.
- 10,070 profiles use stdio transport.
- Remote public service entries account for 278 profiles, a smaller but different boundary.
- For local subprocess MCP servers, files, environment variables, CLI behavior, and network authority become central review topics.
Dataset
| Item | Value |
|---|---|
| Article date | 2026-04-23 |
| Public Registry snapshot | 20,629 entries, synced 2026-06-06T01:17:38.963Z |
| Detailed profile evidence | 11,627 rows, generated 2026-05-20/21 |
| Public disclosure level | Aggregates, distributions, anonymized observations, and operational interpretation |
Observed Metrics
| Metric | Value | Meaning |
|---|---|---|
| local subprocess | 10,335 | Candidates launched as processes on the local machine |
| stdio transport | 10,070 | Candidates connected through standard input/output |
| remote public service | 278 | Candidates whose boundary sits on a remote service |
What We Observed
A local subprocess runs inside the user or developer environment. OS permissions, working directory, environment variables, dependency installation, and host networking all matter. stdio is convenient, but it asks reviewers to think in process boundaries rather than only network authorization. A web API review does not explain what a local process can read.
Practical Reading
Reviewers should inspect not only command and args, but also package source, runtime HOME, working directory, and environment variables. For local MCP servers, dedicated users, limited directories, least privilege, and network restrictions can reduce risk.
Limits
- Execution location is based on public metadata and inspection evidence and may differ from a user's exact configuration.
- stdio is not inherently unsafe.
- Local isolation details vary by operating system and AI client.
Conclusion
A major part of MCP security is endpoint security: what the AI client launches locally and what that process can reach.
MCP Guard continuously turns public Registry and profile evidence into adoption-review signals for MCP security teams.