Only 8.5% of MCP Servers Use OAuth — Here's How to Host One Securely on App Service

Summary

The source article is Microsoft guidance framed around the finding that only 8.5% of MCP servers use OAuth, offering direction on how to host an MCP server securely on Azure App Service. It sits within a broad body of Model Context Protocol (MCP) and LLM-agent security research assembled here rather than describing a single exploited vulnerability or named-actor campaign.^[24]

Trend Micro researchers Alfredo Oliveira and David Fiser (TrendAI Research) report that the population of publicly network-exposed MCP servers has nearly tripled, from 492 confirmed instances in their July 2025 study to 1,467, with many still running without client authentication or traffic encryption. The central escalation is that exposed MCP servers have shifted from passive data backdoors into an active vector for direct cloud attacks, enabling credential theft, lateral movement, and in worst cases full compromise of the hosting cloud services.^[52]

The escalation is corroborated across converging research: Elastic Security Labs documents client-side MCP tool exploits such as obfuscated instructions, rug-pull redefinitions, cross-tool orchestration, and passive influence; the MCPTox benchmark demonstrates systematic tool-poisoning success rates as high as 72.8% against real-world servers with refusal rates under 3%; and Adversa AI's TrustFall shows agentic coding CLIs auto-executing project-defined MCP servers for one-click and zero-click RCE.^[76][84][78]

Underlying all of these is the same trust-boundary weakness illustrated in the RAG prompt-injection demonstration—LLM-driven agents cannot structurally distinguish trusted instructions from untrusted retrieved or tool-supplied content—reinforced by OWASP's framing of prompt injection as a top LLM application risk and by the 'lethal trifecta' analysis of private data, untrusted content, and external communication. The consistent guidance is that organizations should treat MCP servers as critical cloud infrastructure requiring proactive, robust security, including authentication such as OAuth, rather than as experimental tools.^{[0][83][96][52]}

How it works

The root weakness is that LLM agents receive system prompts, developer instructions, user messages, and retrieved documents as one flat token stream with no enforced structural boundary between trusted and untrusted content, so an injected directive inside a retrieved document can be reasoned into being obeyed. A demonstration RAG agent silently pulled sensitive information and emailed credential data to an external address after a knowledge-base document carried injected instructions.^[0]

Tool poisoning embeds malicious instructions within a tool's metadata (not its output) without any execution; the MCPTox evaluation across 45 real-world MCP servers and 353 tools found that more capable models are often more susceptible because the attack exploits their instruction-following ability, and existing safety alignment rarely triggers refusal (under 3% for the best-refusing model, with attack success up to 72.8%).^[84]

Elastic Security Labs details client-side MCP tool exploitation via prompt injection and orchestration, including obfuscated instructions, rug-pull tool redefinitions, cross-tool orchestration, and passive influence, which can lead to data exfiltration or privilege escalation when agents auto-accept tool calls without checking definitions, inputs, or outputs.^[76]

In the TrustFall chain, a malicious repository ships an MCP server and auto-approves it via its own .claude/settings.json, with the entire payload optionally living inline in .mcp.json. Accepting the folder-trust prompt spawns the server as an unsandboxed OS process with the developer's full privileges with a single keypress, and on headless CI runners the trust dialog is skipped entirely, allowing zero-interaction execution against pull-request branches.^[78]

Affected versions and patch status

Key takeaways

• MCP-server exposure is growing fast and its impact is escalating: the exposed-server count nearly tripled to 1,467 and the risk has widened from data access to direct compromise of the hosting cloud services, while only a small fraction of MCP servers use OAuth.^[52][24]
• The recurring failure mode across RAG, MCP tools, and agentic coding CLIs is the absence of an enforced trust boundary between instructions and untrusted content, so mitigations must live in code (authentication, authorization, least privilege, sandboxing, human-in-the-loop) rather than relying on the LLM to police itself.^[0][78][84]
• Prompt injection and tool poisoning are systematically effective against current models, with benchmark attack success rates as high as 72.8% and refusal rates under 3%, so defenders should assume injection can succeed and design blast-radius controls accordingly.^[84][83]

Defensive actions

• Host MCP servers with proper authentication such as OAuth rather than exposing them without client authentication.: Only a small fraction of MCP servers use OAuth, and Trend Micro found the exposed servers lacked authentication and encryption, leaving them open gateways to data and to the hosting cloud services.^[24][52]
• Treat MCP servers as critical cloud infrastructure requiring proactive, robust security, and build a cloud-centric defense; enforce client authentication and traffic encryption and remove servers from public network exposure.: Trend Micro's core recommendation, given that exposed MCP servers can now bridge to full cloud compromise and the 1,467 exposed servers lacked basic controls.^[52]
• Sandbox and gate auto-execution of project-defined MCP servers in agentic coding tools; do not treat folder-trust acceptance as blanket execution consent, and disable auto-approval in CI.: TrustFall demonstrated one-click and zero-click RCE where trusting a repository spawns an unsandboxed process with developer privileges, including against headless CI runners.^[78]
• Validate tool definitions, inputs, and outputs and apply human review before executing MCP tool calls.: MCPTox and Elastic show agents rarely refuse poisoned tool metadata and that autonomous tool acceptance without checking definitions heightens risk.^[84][76]
• Enforce tool authorization and least privilege in backend code and require human-in-the-loop confirmation for sensitive or externally-directed actions, never leaving the LLM as the final authority.: The RAG demonstration showed the agent will follow injected instructions embedded in retrieved content because safety and injected instructions share the same token stream, so code-enforced confirmation and permission layers are needed to block exfiltration after injection succeeds.^[0]
• Apply OWASP Top 10 for LLM Applications guidance, treating prompt injection (direct and indirect) as a primary design risk and integrating humans into LLM-directed decisions; avoid deploying agents that combine private-data access, untrusted content, and external communication.: OWASP identifies prompt injection as a leading LLM risk exploitable to steal information or drive backend actions, and the lethal-trifecta analysis shows that combining those three capabilities lets attackers exfiltrate data.^[83][96]