MCP adoption outpaced its own security tooling
The Model Context Protocol (MCP) now sits in front of production data, internal APIs, and developer machines at thousands of companies, having been adopted far faster than the security tooling needed to audit it safely. Researchers filed more than 30 CVEs against MCP servers between January and February 2026 alone, and a broader review found that 43% of audited MCP servers contained command injection vulnerabilities.
The number that should worry every team using multiple servers
Palo Alto Networks' Unit 42 measured a 78.3% attack success rate once five MCP servers were connected to a single agent — a striking illustration that MCP risk compounds rather than staying constant as more servers are added, since each additional server expands the effective attack surface an adversarial prompt or compromised tool response can exploit.
The core gaps CISA and NSA named specifically
In June 2026, CISA and NSA jointly flagged MCP as an active attack surface, citing specific, recurring gaps across the ecosystem: no OAuth enforcement on many servers, tools that return substantially more data than the requesting task actually needs, missing audit trails that would let a compromise be detected after the fact, and prompt-injection paths carried through tool responses themselves rather than just user input.
The four patterns worth checking in any manifest
- Missing or absent authentication. A server with no auth enforcement can be called by anything able to reach it over the network, with no verification of who or what is making the request.
- Wildcard or overly broad tool scope. A tool scoped to access "everything" or "any" resource grants far more than almost any legitimate task actually requires — the principle of least privilege applies directly to MCP tool scoping.
- Arbitrary command execution tools. A tool that runs shell commands or executes arbitrary code is one of the highest-impact capabilities an MCP server can expose, and is specifically implicated in the 43% command-injection statistic.
- Hardcoded credentials. Secrets embedded directly in a manifest rather than injected via environment variable or secret manager at runtime are exposed to anyone who can read the config file, including through source control if committed.
Why source and maintenance status still matter beyond the config itself
Practical MCP vetting guidance consistently recommends checking the source repository, reviewing permission scope, auditing data flow, and reading the actual tool code where feasible — plus checking for recent CVEs and confirming the repository is still actively maintained, since an abandoned server with a known vulnerability presents ongoing risk with no prospect of a fix.
Why this scales beyond any one server
Given that attack success rates compound as more servers connect to a single agent, auditing each individual MCP server in isolation — rather than treating the aggregate risk of a multi-server setup as simply additive — is the more accurate way to reason about exposure, especially for teams connecting several MCP servers to power a single agentic workflow.
A scan is a starting point, not a certification
A pattern-based scan for these documented gap types catches a meaningful share of common issues quickly, but a 75-point comprehensive MCP security audit — covering auth, secrets handling, tool scoping, audit logs, prompt-injection defense, and abuse-path coverage across eight threat domains — remains the more thorough standard for a server handling genuinely sensitive access.
Frequently Asked Questions
Palo Alto Networks' Unit 42 measured a 78.3% attack success rate once five MCP servers were connected to an agent, showing that risk compounds rather than staying constant as more servers are added, since each additional server expands the effective attack surface available to an adversarial prompt or compromised tool response.
CISA and NSA's June 2026 guidance specifically flagged missing OAuth/authentication enforcement, tools returning more data than a task actually needs, missing audit trails, and prompt-injection paths through tool responses as core, recurring gaps across the MCP ecosystem.
A 2026 review found that 43% of audited MCP servers contained command injection vulnerabilities, and over 30 CVEs were filed against MCP servers in just the January-February 2026 window, reflecting how quickly adoption has outpaced security tooling for this protocol.
No. A pattern-based scan for known gap types — missing auth, wildcard scope, command execution tools, hardcoded secrets — catches common issues quickly, but a comprehensive MCP security audit covers many more points (commonly cited frameworks run to 75 checks across eight threat domains) and remains the more thorough standard for sensitive access.
Yes — the MCP Server Security Auditor genuinely parses a pasted MCP manifest/config JSON and checks it against the documented 2026 gap patterns: missing authentication, wildcard tool scopes, arbitrary command execution tools, and hardcoded credentials.