Technical Summary: Exposed by Design

Problem Statement

The Model Context Protocol (MCP), released by Anthropic in November 2024, has rapidly become the de facto integration layer for agentic AI applications, connecting Large Language Models (LLMs) to external tools and data sources. While adoption has surged to over 21,000 publicly reachable server instances, the security posture of these deployments remains largely uncharacterized.

Existing security research has been bifurcated into theoretical threat modeling or static analysis of registry entries and source code. These approaches fail to capture the runtime security posture of live, internet-facing servers. The paper identifies a critical gap: the lack of empirical data on the prevalence of vulnerabilities in deployed MCP servers, particularly those arising from the protocol's unique design where natural-language tool descriptions are structurally coupled with code execution. The author posits that the minimal barrier to exposing services as MCP endpoints has led to a deployment landscape operating below the security baseline of conventional internet services, characterized by a lack of authentication, exposed shell execution capabilities, and rapid, ephemeral deployment cycles.

Methodology

The study employs a two-phase methodology combining passive discovery with active dynamic behavioral testing.

1. Passive Discovery (Petrel)

The author developed Petrel, a discovery pipeline that aggregates candidates from eleven heterogeneous data sources to maximize coverage of the MCP ecosystem:

• Certificate Transparency Logs: crt.sh for SSL/TLS certificates containing MCP-indicative substrings.
• Developer Platforms: GitHub (topic searches, filename matching), HuggingFace Spaces, and npm/PyPI registries.
• Specialized Registries: Smithery, glama.ai, and pulsemcp.com.
• Internet Scanners: Censys, FOFA, and Shodan.

Candidates undergo active HTTP fingerprinting to distinguish live MCP servers from false positives. Petrel probes both the current Streamable HTTP transport (via POST with a JSON-RPC initialize request) and the legacy SSE transport. Only servers responding with valid protocol handshakes are confirmed for testing.

2. Dynamic Security Testing (Corvus)

The author introduces Corvus, an open-source framework designed for dynamic behavioral assessment. Corvus subjects confirmed servers to 34 test modules (13 static, 21 dynamic) covering the MCP Security Top 10 (MST-10), a new vulnerability taxonomy derived from the study's findings.

• Execution Model: Corvus utilizes a multiplexed StdioTransport reader loop to pipeline JSON-RPC requests, enabling high-throughput testing across parallel groups.
• Testing Strategies:
  • Tool Poisoning: Injecting shadow tool definitions to test for dynamic mutation (rug-pull attacks).
  • Injection: Submitting crafted payloads to test for SQL injection, command injection, and prompt injection via tool outputs.
  • SSRF & URI Manipulation: Testing resource URIs and pagination cursors for path traversal and Server-Side Request Forgery (SSRF) against cloud metadata services (e.g., AWS IMDS).
  • Schema Bypass: Fuzzing JSON-RPC messages to identify parser ambiguities.
• Output: Findings are scored by confidence (0–100) and output in SARIF 2.1.0 format. High-confidence findings undergo manual triage and are reported via GitHub Security Advisories (GHSA) under a 90-day coordinated disclosure embargo.

Key Contributions

The paper makes five primary contributions:

1. First Dynamic Behavioral Assessment: The first large-scale, dynamic security audit of internet-facing MCP servers, confirming 640 unique production deployments and auditing 414 of them.
2. Corvus Framework: The release of an open-source tool implementing 34 test modules across all 10 MST-10 categories, supporting both Streamable HTTP and SSE transports.
3. Multi-Source Discovery Methodology: A demonstration that no single data source adequately captures the MCP population, necessitating a pipeline spanning eleven sources to achieve comprehensive coverage.
4. Characterization of Deployment Churn: Empirical evidence of a 41.6% server disappearance rate within 72 hours, indicating a deployment model driven by ephemeral experimentation rather than stable operational security.
5. Responsible Disclosure Pipeline: The identification and responsible disclosure of 68 vulnerabilities, including SQL injection, SSRF, and prompt template injection, with 19 publicly disclosed and 49 under embargo at the time of writing.

Results

Across four measurement runs in July 2026, the study yielded the following findings:

• Authentication Deficiencies: 91.8% of dynamically audited servers (380/414) lack OAuth authentication. The majority operate with no authentication or static, predictable bearer tokens.
• Unauthenticated Shell Execution: 687 tool instances across the confirmed server pool expose shell execution capabilities (e.g., bash_execute, run_command) without any access controls, allowing remote code execution by any network adversary.
• Vulnerability Prevalence: The study identified 68 reportable vulnerabilities. Critical findings include:
  • SQL Injection: Confirmed via response-size differentials in a corpus search tool.
  • SSRF: Confirmed via timing oracles (11.9s latency vs. 0.3s baseline) when targeting AWS Instance Metadata Service.
  • Prompt Template Injection: Confirmed by injecting control sequences that overrode system instructions in an AI assistant.
  • Path Traversal: Achieved via cursor manipulation in pagination primitives.
• Ecosystem Churn: 41.6% of servers confirmed in one measurement run were unreachable 72 hours later. This churn rate suggests that many servers are transient artifacts of CI/CD pipelines or developer experimentation, complicating long-term monitoring and patch verification.

Significance and Claims

The paper claims to provide the first empirical baseline for the security posture of the MCP ecosystem. Its significance lies in shifting the understanding of MCP security from theoretical threat modeling to observed reality.

The author argues that the security risks are structural, not accidental. The protocol was designed primarily for local stdio transport, where OS process isolation provides security. The subsequent addition of HTTP transport, without commensurate security defaults (such as mandatory OAuth), has resulted in a "path of least resistance" that produces unauthenticated, internet-facing servers by default.

The study concludes that the MCP ecosystem currently operates below the minimum operational security baseline of conventional internet services. The combination of unauthenticated shell execution, the absence of authentication layers, and rapid, ephemeral deployment cycles creates an attack surface where vulnerabilities are not only prevalent but easily exploitable. The author asserts that their work demonstrates that MCP security is an active, exploitable attack surface requiring immediate attention from SDK developers, platform providers, and registry operators to enforce security defaults and improve disclosure mechanisms.