The MCP ecosystem has a trust problem — and scanning source code won't fix it

The Model Context Protocol ecosystem is growing fast. Thousands of MCP servers now offer tools that AI agents call autonomously — executing code, querying databases, moving money, managing infrastructure. Agents are making decisions on behalf of humans, and those decisions depend on servers they've never met.

Recently, a well-circulated analysis scanned roughly 1,800 MCP servers and found security issues in a significant percentage of them. That work was valuable. Static analysis catches real bugs: injection vulnerabilities, missing input validation, insecure defaults.

But here's the question nobody asked: what happens after deployment?

A server can pass every static check and still behave terribly in production — dropping requests, responding with garbage after midnight, degrading quietly over weeks until an agent makes a costly mistake. Static analysis is a snapshot. Production is a film.

We built Dominion Observatory to watch the film.

Behavioral trust scoring: what it is and why it matters

Dominion Observatory provides behavioral trust scores for 14,800+ MCP servers — nearly 8x the coverage of the largest published static analysis. But coverage isn't the point. The methodology is.

Instead of reading source code, Dominion scores servers based on how they actually behave at runtime:

• Success rates — Does the server reliably return valid responses, or does it fail silently?
• Latency profiles — Is response time consistent, or does it spike unpredictably?
• Uptime patterns — Is the server available when agents need it, or does it vanish during peak hours?
• Interaction history — How does the server perform across thousands of real tool calls over time?
• Anomaly detection — Has the server's behavior suddenly changed in a way that suggests compromise, misconfiguration, or degradation?

A trust score isn't a binary pass/fail. It's a continuous signal that reflects a server's operational reputation — built from observed behavior, not assumed intent.

What behavioral scoring actually reveals

When you shift from "does this code look safe?" to "does this server behave reliably?", you start seeing patterns that static analysis simply cannot detect.

Degradation over time. A server that worked perfectly three months ago might now be timing out on 30% of requests. No code changed — maybe the underlying infrastructure shifted, maybe a dependency started throttling, maybe the maintainer moved on. Static analysis sees the same clean code. Behavioral scoring sees the decay.

Inconsistent reliability across tools. A single MCP server might expose five tools where four perform well and one is essentially broken. Behavioral scoring operates at the granularity of individual tool interactions, not just the server as a whole.

Anomalous behavior shifts. A server that suddenly starts returning responses 10x faster than its historical baseline might sound like good news — or it might mean it's returning cached garbage instead of computing real results. Anomaly detection flags deviations in both directions.

Availability patterns. Some servers are rock-solid during US business hours and unreachable at other times. For a global agent economy, that's a reliability concern that only shows up through continuous observation.

These aren't theoretical scenarios. They're the kinds of signals that emerge when you instrument trust at the behavioral layer.

From scoring to settlement: trust as infrastructure

Dominion Observatory isn't a dashboard you check once. It's infrastructure that agents query in real time, at the moment of decision.

The system is itself an MCP server (available via Streamable HTTP at https://dominion-observatory.sgdata.workers.dev/mcp), which means any MCP-capable agent can call it natively. The core tools:

• get_trust_score — Retrieve the behavioral trust score for any MCP server before calling it
• detect_anomalies — Check whether a server is currently exhibiting unusual behavior
• get_leaderboard — See which servers rank highest for reliability in a given category
• get_ecosystem_stats — Understand the overall health of the MCP ecosystem
• report_tool_outcome — Contribute your own interaction data back to the scoring engine

The most consequential integration point is the beforeSettle hook. In agent-to-agent payment flows — where one agent pays another for a service rendered via MCP — the trust score can gate whether settlement proceeds. If a server's behavioral trust has dropped below a threshold, the payment holds. This turns trust from a nice-to-have metric into an economic primitive.

Think of it as a credit score for MCP servers. Not based on who they say they are, but on what they've actually done.

Static and behavioral analysis are complements, not competitors

To be clear: static analysis is important. You should absolutely scan MCP servers for injection flaws, validate their input handling, and audit their permission models. Tools that do this well are doing necessary work.

But static analysis answers the question: "Could this server misbehave?"

Behavioral scoring answers the question: "Is this server misbehaving?"

The first is a security audit. The second is an operational reputation system. A mature MCP ecosystem needs both — just as the traditional web needs both code review and uptime monitoring.

The difference becomes critical as the agent economy scales. When thousands of agents are autonomously selecting which MCP servers to call, making payments, and chaining tool calls across multiple servers, you need trust signals that operate at runtime speed and reflect current reality. You can't re-audit source code on every request. You can query a behavioral trust score in milliseconds.

The agent economy needs accountability infrastructure

We're at an inflection point. MCP adoption is accelerating, and the servers agents depend on are increasingly operated by unknown third parties. The agent economy will either develop robust trust infrastructure, or it will learn expensive lessons about what happens when autonomous systems make decisions without accountability.

Dominion Observatory is our contribution to the first outcome. It's open source, it's composable, and it's designed to be infrastructure that other systems build on — not a walled garden.

Try it now

Query it directly. Point any MCP client at https://dominion-observatory.sgdata.workers.dev/mcp using Streamable HTTP transport. Call get_ecosystem_stats to see the current state of the ecosystem, or get_trust_score for any server you're curious about.

Contribute data. The scoring engine gets better with more interaction data. Use report_tool_outcome to feed back your own observations about MCP server behavior. More data means more accurate trust signals for everyone.

Star the repo. The engine is open source at github.com/vdineshk/daee-engine. Issues, PRs, and ideas are welcome.

Build on it. If you're building agent infrastructure — orchestration frameworks, payment rails, marketplace platforms — behavioral trust scoring is a building block. Integrate it. Extend it. Make agents smarter about who they trust.

The MCP ecosystem is too important to fly blind. Let's build the accountability layer together.