Research
Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale
Publication date not yet evaluated · Added · 7 reports arxiv.org
Page published · Page updated
Coverage timeline
Why it matters
MCP servers increasingly connect AI agents to internal systems and third-party tools, so the finding that nine in ten public servers run without authentication and hundreds expose shell execution shows a broad, exploitable attack surface defenders must audit.
A one-year retrospective on Model Context Protocol security, anchored on the arXiv study 'Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale,' reports that 91.8% of dynamically audited MCP servers lack OAuth authentication and that 68 reportable vulnerabilities (SQL injection, SSRF against cloud metadata, prompt template injection, path traversal) were found across 414 audited production servers, with 687 tool instances exposing shell execution without access controls. The research releases Corvus, an open-source framework of 34 test modules covering 10 MCP-specific vulnerability classes, and notes rapid, unreviewed deployment cycles.
Summary
An arXiv research paper by Nicolás Padilla presents the first dynamic behavioral security assessment of internet-facing Model Context Protocol (MCP) servers at scale. Since MCP's November 2024 launch, over 21,000 server instances are detectable on the public internet, and the study combined passive discovery across eleven data sources with active dynamic testing.[2]
Using Corvus, a purpose-built framework of 34 test modules covering 10 MCP-specific vulnerability classes, the researchers confirmed 640 production MCP servers, dynamically audited 414, and uncovered 68 reportable vulnerabilities including SQL injection, SSRF targeting cloud metadata services, prompt template injection, and path traversal via cursor manipulation.[2]
The findings highlight systemic insecurity by design: 91.8% of audited servers lack OAuth authentication, 687 tool instances expose shell execution capabilities without access controls, and 41.6% of confirmed servers vanish within three days between runs — evidence of rapid deployment cycles without security review. The work is framed as vulnerability research with a responsible disclosure pipeline and an open-source release of Corvus, not as observed in-the-wild campaign activity.[2]
Disclosure timeline
| Date | Event |
|---|---|
| November 2024 | Model Context Protocol (MCP) is launched, followed by rapid adoption reaching over 21,000 detectable public server instances.[2] |
| July 2026 | Four measurement runs conducted; 640 production MCP servers confirmed and 414 dynamically audited, yielding 68 reportable vulnerabilities reported through a responsible disclosure pipeline.[2] |
| 31 Jul 2026 | Paper 'Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale' submitted to arXiv (v1).[2] |
How it works
The study identifies 10 MCP-specific vulnerability classes exercised via 34 active test modules. Confirmed defects include SQL injection, server-side request forgery (SSRF) directed at cloud metadata services, prompt template injection, and path traversal achieved through cursor manipulation.[2]
A dominant structural weakness is missing authentication: 91.8% of dynamically audited servers lack OAuth, allowing unauthenticated interaction. In addition, 687 tool instances across confirmed servers expose shell execution capabilities without any access controls, providing direct command-execution surface.[2]
Because a malicious or misconfigured MCP server sits in the same architectural slot as a legitimate connector and abuses an already-accepted trust boundary, it can capture prompts, reuse available credentials, expose configuration secrets, return crafted tool responses, or steer the agent toward unsafe actions without breaking the transport layer.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Internet-facing Model Context Protocol (MCP) servers | Production servers reachable on the public internet; 640 confirmed and 414 audited, with 91.8% lacking OAuth authentication and 687 tool instances exposing uncontrolled shell execution. | Findings reported via a responsible disclosure pipeline; no aggregate patch status provided.[2] |
Key takeaways
- Internet-facing MCP servers are widely deployed and frequently insecure by design: the majority lack authentication and many expose shell execution without access controls.[2]
- MCP servers exhibit rapid, unreviewed deployment cycles — 41.6% disappeared within three days — compounding the difficulty of security governance for agentic AI integrations.[2]
- Corvus, an open-source framework with 34 test modules across 10 MCP vulnerability classes, provides a reusable methodology for defenders to dynamically evaluate MCP server security.[2]
- MCP endpoints should be treated as untrusted tool endpoints unless proven otherwise, with explicit scoping, authentication, and provenance review for every server admitted to an agent workflow.[1]
Defensive actions
- Require strong authentication (e.g., OAuth) for every MCP server connection and token exchange.: 91.8% of audited MCP servers lacked OAuth authentication, leaving them openly interactable; enforced authentication closes this systemic gap.[2][1]
- Constrain and validate tool invocation paths, and remove or restrict uncontrolled shell execution capabilities.: 687 tool instances exposed shell execution without access controls, and validating each MCP tool action before execution limits abuse of agent tool paths.[2][1]
- Treat MCP servers as untrusted, security-relevant dependencies with least-privilege scoping and provenance vetting before deployment.: Malicious MCP servers abuse accepted trust boundaries and often hold more access than the task requires; scoping and vetting reduce blast radius.[1]
- Remove secrets from MCP configurations and rotate any exposed credentials.: Hard-coded credentials and weak tool scoping are common MCP exposure patterns that leak secrets through prompts or configs.[1]