MCP security, explained

What MCP security is, and why it matters now.

MCP servers are the connectors that let AI assistants and agents use your tools and data, through an open standard called the Model Context Protocol (MCP). If one is wrong, an agent, or anyone who can reach the server, can be made to read, send or change things it never should.

Last reviewed

The 30-second version

The server decides what the agent can do.

An AI assistant asks an MCP server which tools exist, reads their descriptions and calls them; the server then acts on real systems such as email, code and databases. That makes the server a new kind of front door, used by software that follows written instructions. The official introduction calls MCP “a USB-C port for AI applications”: useful for the same reason it needs testing.

Where an MCP deployment can be attackedAn AI agent calls tools on an MCP server and receives the tool list and results; anyone who can reach the server can call it too. The server acts on your tools and data and returns their content. Five numbered attack points: 1, unauthenticated callers; 2, poisoned tool descriptions; 3, untrusted content returned by tools; 4, changes to the server's code or package; 5, transport and session flaws. mcpprobe tests the MCP server boundary.AI assistant or agentthe MCP clientAnyone whocan reach it5calls tools2tool list1What mcpprobe testsMCP serverauthentication · sessionstool list and descriptionsits code and package4acts on3returns contentYour tools and dataemail · code · ticketsdatabases · files
The five numbered points are where the public incidents below happened. mcpprobe tests the server boundary, the dashed line, from the outside, the way a client or an attacker would reach it.
  1. 1. Anyone can call it: The server answers callers who never authenticated.
  2. 2. The tool description gives orders: Text the agent reads as instructions arrives with the tool list.
  3. 3. Untrusted content hijacks the agent: Web pages, issues or email returned by a tool steer the agent.
  4. 4. A trusted package turns bad: A new version of the server's code changes what it does.
  5. 5. The plumbing is exploitable: Transport, session and input-handling bugs in the server or client.

Five ways it goes wrong

Each one has already happened in public.

Each risk is mapped to the OWASP MCP Top 10, which is still in beta, so items are cited as MCP01:2025 to MCP10:2025. Every number below gives its source, its date and what it counts.

  1. Anyone can call it

    MCP07:2025 · MCP01:2025

    A server that does not check who is calling will list its tools, and often run them, for anyone who finds its address. No agent is needed: a single HTTP request is enough.

    On the record. Of the internet-exposed MCP servers Wiz observed, about 70% returned their full tool list to an anonymous caller and about 42% returned real data when a tool was called (Wiz, 28 Jul 2026). In Trend Micro's study of 9,695 servers listed in public directories, “no authentication” was the largest group of the 4,982 issues found: 2,054 issues, or 41% of issues, not of servers (Trend Micro, 24 Jun 2026).

    What mcpprobe checks. Today: AUTH-01, AUTH-02, AUTH-03, AUTH-04.

  2. The tool description gives orders

    MCP03:2025 · MCP02:2025

    Every tool comes with a description that the AI model reads before it decides what to do. If that text contains instructions, the agent may follow them, even if the tool itself is never called. A description can also change after you approved it.

    On the record. Invariant Labs showed a poisoned tool description being used to exfiltrate a user's WhatsApp message history in April 2025 (AuthZed timeline).

    What mcpprobe checks. Today: META-01, META-02, META-03, META-04, META-05.

  3. Untrusted content hijacks the agent

    MCP06:2025 · MCP10:2025

    Tools that fetch web pages, issues or email hand the agent text written by someone else. If the agent treats that text as instructions, an outsider is steering it. The risk is highest when one agent has private data, reads untrusted content and can send data out.

    On the record. In May 2025 a public GitHub issue led an agent using the GitHub MCP server to leak private repository data (Invariant Labs, in the AuthZed timeline). Simon Willison calls that combination of private data, untrusted content and a way out “the lethal trifecta” (Simon Willison, 16 Jun 2025).

    What mcpprobe checks. Coming soon: INJ-05. Most of this risk lives in how the agent and its tools are combined, not in one server, so a server scan can only show part of it. We say so in every report.

  4. A trusted package turns bad

    MCP04:2025

    MCP servers are installed from package registries like any other code. A new version can change what a server does without changing what it says it does.

    On the record. Version 1.0.16 of the postmark-mcp npm package added one line that blind-copied every email it sent to an outside address. It had 1,643 downloads before it was removed (The Hacker News, 29 Sep 2025).

    What mcpprobe checks. Today: META-02. Coming soon: SUPPLY-01, SUPPLY-02, SANDBOX-01. META-02 flags a changed tool list today. A change hidden inside the code, like this one, needs the package and sandbox checks that are coming soon.

  5. The plumbing is exploitable

    MCP05:2025 · MCP07:2025

    MCP servers and clients are ordinary software with ordinary bugs: commands built from tool arguments, file paths that escape their folder, sessions that can be guessed, and connections a web page can open from a visitor's browser.

    On the record. CVE-2025-6514 in mcp-remote, rated CVSS 9.6, let a malicious server run commands on the client that connected to it (JFrog, 9 Jul 2025). In Trend Micro's study, arbitrary file access (880 issues) and command injection (476 issues) were among the largest groups after missing authentication (Trend Micro, 24 Jun 2026).

    What mcpprobe checks. Today: TRANS-01, TRANS-03, TRANS-05, ERR-01, DOS-01. Coming soon: INJ-01, INJ-02, INJ-03, INJ-04.

OWASP MCP Top 10 (beta)

All ten items, and which ones a scan can test.

Built from the check catalogue, so it always matches what the scanner does. “Mapped to” means a check gives evidence for that item. It is not a certification.

OWASP MCP Top 10 items and mcpprobe coverage
ItemIn plain Englishmcpprobe checksStatus
MCP01:2025Token Mismanagement & Secret ExposureSecrets and tokens leak or are accepted carelesslyAUTH-03, AUTH-04, TRANS-05, META-05Tested today
MCP02:2025Privilege Escalation via Scope CreepTools can do more than they claimMETA-03Tested today
MCP03:2025Tool PoisoningTool descriptions carry instructionsMETA-01, META-02Tested today
MCP04:2025Software Supply Chain Attacks & Dependency TamperingThe package itself turns badSUPPLY-01, SUPPLY-02, SANDBOX-01Coming soon
MCP05:2025Command Injection & ExecutionTool arguments reach a shell, file path or queryMETA-03, META-04, INJ-01, INJ-02, INJ-03, INJ-04, SUPPLY-02Partly today, more coming soon
MCP06:2025Prompt Injection via Contextual PayloadsContent returned by tools steers the agentINJ-05Coming soon
MCP07:2025Insufficient Authentication & AuthorizationAnyone can call it, or with the wrong tokenAUTH-01, AUTH-02, AUTH-03, AUTH-04, TRANS-01, TRANS-03Tested today
MCP08:2025Lack of Audit and TelemetryNobody can see what the tools didERR-01, GOV-01Partly today
MCP09:2025Shadow MCP ServersServers nobody knows are runningGOV-02Not testable by a scan; listed in every report
MCP10:2025Context Injection & Over-SharingMore data reaches the model than it needsINJ-05Coming soon

Why now

Eighteen months, on the record.

MCP servers are being shipped faster than they are tested. These are the public, dated events behind that sentence.

  1. A poisoned tool description is used to exfiltrate WhatsApp message history (Invariant Labs; AuthZed timeline).

  2. A public GitHub issue leads an agent to leak private repository data through the GitHub MCP server (AuthZed timeline).

  3. Simon Willison names “the lethal trifecta” of private data, untrusted content and a way out (Simon Willison, 16 Jun 2025).

  4. CVE-2025-6514 in mcp-remote, CVSS 9.6, is disclosed (JFrog, 9 Jul 2025).

  5. The first malicious MCP server is found on npm: postmark-mcp (The Hacker News, 29 Sep 2025).

  6. OWASP publishes its Top 10 for Agentic Applications (Giskard summary).

  7. Censys counts 12,520 internet-accessible MCP services in a snapshot taken on 28 April 2026 (Censys, 27 May 2026, snapshot of 28 Apr 2026).

  8. Trend Micro finds 4,982 issues across 9,695 listed MCP servers (Trend Micro, 24 Jun 2026).

  9. Wiz reports that about 70% of the exposed MCP servers it observed list every tool to an anonymous caller (Wiz, 28 Jul 2026).

  10. The OWASP MCP Top 10 is still in beta (OWASP, checked 27 Oct 2026), and the official MCP Registry leaves security scanning to others (registry About page).

What to do

What good looks like.

  • Require a token on every request, and publish OAuth metadata the way the MCP authorization spec describes.
  • Check the Origin header and make session ids impossible to guess.
  • Keep tool descriptions to descriptions, and record the tool list so that a change is noticed.
  • Never build shell commands, file paths, URLs or queries from tool arguments without checking them.
  • Pin package versions and review the commands in client configs as carefully as code.

Some of it no scanner can check from outside: audit logging of tool calls (MCP08), knowing which MCP servers your organisation runs (MCP09), and how your agent combines tools. Every mcpprobe report lists these as items to confirm yourself, rather than marking them passed.

The full MCP security checklist for 2026

How mcpprobe helps

Test yours the way an attacker would.

mcpprobe connects to your MCP server the way an AI client would, runs read-only tests for the risks above, and records the request and response behind every finding, with the fix. The CLI is free and open source and runs today; hosted re-testing on a schedule is planned for mid-November 2026. Only test servers you own or are authorised to test.

Terminal
pipx install mcpprobe-scanner
mcpprobe https://your-server.example/mcp

Not sure where you fit? See who it is for, or read a finished sample report.

Find out what your server answers to a stranger.

One command, read-only by default, against a server you own.

Run your first scanSee a sample report

Sources

  1. Model Context Protocol, What is the Model Context Protocol (MCP)? (accessed 28 Oct 2026)
  2. AuthZed, A timeline of MCP breaches (25 Nov 2025, updated 30 May 2026)
  3. Simon Willison, The lethal trifecta for AI agents (16 Jun 2025)
  4. JFrog, Critical remote code execution vulnerability in mcp-remote (CVE-2025-6514) (9 Jul 2025)
  5. The Hacker News, First malicious MCP server found (postmark-mcp) (29 Sep 2025)
  6. Giskard, OWASP Top 10 for Agentic Applications 2026, explained (list published Dec 2025)
  7. OWASP, MCP Top 10 project page (beta, checked 27 Oct 2026)
  8. Censys, MCP servers on the internet (27 May 2026, snapshot of 28 Apr 2026)
  9. Trend Micro, Stars don't save you: popularity is not security in the MCP ecosystem (24 Jun 2026)
  10. Wiz, The risk hiding behind exposed MCP servers (28 Jul 2026)
  11. MCP Registry, About the registry (accessed 28 Oct 2026)

Sources as accessed on 28 October 2026.