MCP Security: Vulnerabilities & Best Practices

Layer 1: Code Execution

The original attack pattern: bad input reaches exec(), shell interprets it, attacker wins.

26 CVEs (87%)

Layer 2: Injection Classes

New attack classes: eval() injection, environment variable injection.

2 CVEs (7%)

Layer 3: Developer Targeting

Attacks targeting developers building MCP infrastructure, not end users.

2 CVEs (7%)

Including in Anthropic's own reference implementation

3

Servers exposed without authentication

4

New class - dynamic code execution vulnerabilities

2

New class - injecting malicious env vars

2

Attacks on the client implementation

2

MCP servers visible on public internet

8,000+

1. Unauthenticated Servers

Research shows 8,000+ MCP servers exposed on the public internet. Many have admin panels, debug endpoints, or API routes without authentication.

2. Data Exfiltration

MCP servers with access to sensitive data (databases, file systems, APIs) can be exploited to leak confidential information.

3. Tool Poisoning

Malicious tool definitions can be injected into agent workflows, causing unintended actions or data access.

4. Parameter Injection

Attackers manipulate tool parameters to execute unauthorized actions beyond the intended scope.

5. Supply Chain

Compromised MCP libraries, dependencies, or third-party servers can introduce backdoors into AI agent workflows.

6. Clawdbot Incident

In January 2026, Clawdbot ecosystem - one of the most popular MCP-based tools - experienced a catastrophic security incident within 72 hours of viral adoption.

Authentication

• Implement strong authentication for all MCP servers
• Use short-lived tokens with limited scope
• Separate credentials for different access levels
• Enable MFA where possible

Network Isolation

• Run MCP servers in isolated network segments
• Use VPCs and private subnets
• Implement firewall rules
• Avoid exposing servers to public internet

Tool Verification

• Audit all tool definitions before use
• Verify server provenance and signatures
• Review third-party MCP servers thoroughly
• Maintain SBOM for MCP dependencies

Least Privilege

• Grant minimum necessary permissions
• Scope tokens to specific resources
• Implement rate limiting
• Log and monitor all tool invocations

Reconnaissance

• Identify exposed MCP servers
• Map API endpoints and authentication
• Document integrated tools and permissions
• Review server configuration

Vulnerability Assessment

• Test for authentication bypass
• Check for injection vulnerabilities
• Verify input validation
• Assess network isolation

Exploitation

• Test parameter manipulation
• Attempt tool poisoning
• Verify data exfiltration risks
• Check for privilege escalation