Published by Anthropic in November 2024 As an open protocol for connecting AI models to external tools and data sources, the Model Context Protocol (MCP) has established itself in less than two years as the de facto standard of the agent-based ecosystem: more than 97 million monthly downloads of its development kit, more than 10 000 servers listed in the official registry, and native support now built into Claude, ChatGPT, Gemini, Cursor, VS Code, and Microsoft Co-pilot. This rapid adoption has a downside that has been documented with unusual precision for such a recent issue: between January and February 2026 alone, security researchers filed more than 30 CVEs targeting MCP servers, clients, and infrastructure, resulting in a total of over 437,000 compromised downloads.
How an MCP Server Works: What Kinds of Access Does the AI Have?
An MCP server provides an AI application with three types of resources: data, preconfigured prompts, and executable tools. In practice, it acts as a bridge between a model’s reasoning engine and the enterprise infrastructure; it can store authentication tokens for multiple services, execute system commands, read files, or query databases. The protocol’s official security policy is explicit on this point: an MCP client trusts the server to which it connects, and a local MCP server must be treated with the same caution as software installed on the workstation—not as a simple, harmless configuration.
Why does MCP have so many vulnerabilities in such a short period of time?
Three factors explain this unusual concentration of incidents. First, a recurring architectural flaw: several of the most critical CVEs stem from a failure to validate the origin of requests, allowing a simple web page to communicate with a locally running MCP server. This is exactly the pattern observed in CVE-2025-49596 (CVSS 9.4), which affected Anthropic’s official MCP Inspector (the development interface used to test servers before deployment) and allowed the execution of arbitrary commands without authentication.
Next, the consolidation of credentials into a single point: an MCP server often centralizes access to multiple enterprise services simultaneously, making it a single point of failure. If compromised, it instantly exposes all the databases, file systems, and cloud services to which it is connected. Security studies published between 2025 and 2026 highlight the still-limited maturity of the MCP ecosystem. Depending on the scope and methodologies used, these studies identify risk rates ranging from 30% to 82%: Equixly notably reports a 30% exposure to SSRF vulnerabilities, while Endor Labs finds that 82% of the 2,614 implementations analyzed use file operations vulnerable to path traversal. Furthermore, the study by Astrix Security indicates that only 8.5% of the MCP servers examined use OAuth as an authentication mechanism.
Finally, a supply chain risk specific to the ecosystem: in September 2025, Koi Security identified what is believed to be the first malicious MCP server observed in real-world conditions: the npm package postmark-mcp. Version 1.0.16 of this package added a backdoor that secretly copied every processed email to an address controlled by the attacker, illustrating the supply chain risk associated with MCP servers. In May 2025, Invariant Labs documented an attack involving an injection ofe prompt targeting GitHub’s official MCP server. A malicious ticket published in a public repository could trick an agent into accessing private repositories to which the user’s token also granted access, and then exfiltrating the data to a public location. The researchers recommended limiting the agent’s permissions to only the necessary repositories, ideally using tokens with minimal privileges.
Excessive agency: a key risk posed by AI agents
The OWASP Top 10 LLM classifies risks associated with connected agents and external tools—including excessive permissions and the execution of actions triggered by manipulated outputs—under the category LLM03:2026, “Excessive Agency.” The organization recommends limiting the extensions that can be called by the agent to only what is strictly necessary and monitoring the actions performed on downstream systems.
How to Secure an MCP Server: 5 Best Practices
The following recommendations are based on those of the MCP Security CheatSheet published by OWASP :
- Authenticate remote connections: Use OAuth 2.1/OIDC, mTLS, or an equivalent mechanism for MCP servers exposed on a network. For local servers, use stdio or a Unix socket rather than an HTTP server accessible to a browser.
- Limit token permissions: Use distinct credentials for each server, narrow OAuth scopes, and short-lived tokens, in accordance with the principle of least privilege.
- Protect local servers: When a local MCP server uses HTTP, restrict access to 127.0.0.1 and strictly validate the Origin header to prevent requests from a malicious web page.
- Verify the origin of servers and tools: allow only approved servers, monitor changes to their descriptions, and look for risks of tool poisoning, rug pulls, and compromised dependencies.
- Log tool calls: Record calls, data requests, errors, and authorization decisions, while centralizing logs and masking secrets or sensitive data.
→ See our guide to AI architectures and risk vectors to understand where MCP fits among the other components of an agent-based architecture.
FAQ: Security and Deployment of the MCP Protocol
Should we avoid MCP to minimize the risks associated with these agents?
No. The protocol standardizes and documents the connections between models and tools, which makes security audits easier rather than more difficult, provided that the deployed servers are properly configured and authenticated.
Is an official MCP server completely secure?
Although official servers generally receive more frequent updates, they are not immune to zero-day vulnerabilities: Anthropic’s official MCP Inspector itself was the target of the most critical vulnerability documented to date in this ecosystem.
How can you detect uninventoried MCP servers on your network?
A phase of technical assessment and network traffic analysis makes it possible to map the Shadow AI and identify active MCP instances on the information system—a service directly integrated into ourAI systems security audit.
Securing Your MCP Integrations
Our experts audit your deployed MCP servers and test their resilience as part of our AI-powered penetration testing service.
Would you like to discuss your project or assess your needs? Contact our experts.