I scanned 229,539 MCP tool parameters. Here's how many can move your money.

Body:

We froze a SHA-256-anchored census of the public MCP ecosystem on 2026-10-12:
42,163 servers, 229,539 tool parameter schemas. Every number below recomputes
from the frozen exports (screening script, CC0):

• 3,456 servers ship a funds-movement surface. 1,301 of them have write polarity — tools that can move money, not just read balances.
• 2,663 servers combine money AND credential handling in one trust boundary. If a prompt injection lands on one of these, the blast radius is "spend" not "read".
• 9,761 servers touch account identity data in tool parameters.

The uncomfortable part: this is only the public ecosystem. Enterprise-internal
MCP deployments — invisible to any census — are where the regulated traffic
actually lives.

What we did about it (and what you can reuse, CC0):

1. A risk gazetteer schema where every label must carry an evidence chain (frozen parameter path + vocabulary rule ref). No naked labels — an unlabeled claim is unverifiable and must be omitted. We think "no naked labels" is the difference between a risk list and a liability.
2. A signed receipt format (Ed25519 over RFC 8785 canonical bytes, hash-chained, offline-verifiable) so a decision record can be checked by a third party without trusting either the agent or the tool host.
3. A fail-closed rollback-evidence receipt: an "executed reversal" claim without a transaction reference is rejected by the checker. "We compensated" is not evidence; a verifiable reversal bound to the original decision is.

Census: Zenodo DOI 10.5281/zenodo.24028716 (white paper)
Code + schema: github.com/DSHCorrectover/mcp-risk-gazetteer (CC0)
Vectors + checker: github.com/DSHCorrectover/ccs-conformance-vectors (CC0 data / MIT checker)

We would rather be corrected than wrong — if you recompute the numbers and
get something else, that's a bug report we want.