Research · curated 5 Aug 2026
Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale
First reported · updated · 3 reports arxiv.org
Coverage timeline
Why it matters
The measurement shows that the vast majority of publicly exposed MCP servers lack authentication and often expose shell execution, giving defenders concrete evidence of a rapidly-deployed, insecure agentic attack surface.
An arXiv paper by Nicolás Padilla presents the first dynamic behavioral security assessment of internet-facing Model Context Protocol (MCP) servers, discovering over 21,000 instances, confirming 640 production servers, and dynamically auditing 414 using Corvus, a purpose-built framework with 34 test modules across 10 MCP-specific vulnerability classes. The study uncovered 68 reportable vulnerabilities including SQL injection, SSRF targeting cloud metadata, prompt template injection, and path traversal, and found 91.8% of audited servers lack OAuth authentication and 687 tool instances exposing shell execution without access controls. The authors release Corvus as an open-source MCP security evaluation framework.