This month CISA and NSA issued joint guidance naming the Model Context Protocol as an emerging attack surface. The core concern is plain: MCP servers expose internal tools and data to AI models with few of the guardrails enterprises apply to their APIs. The guidance is a reasonable baseline to design against. It also arrives after a year of measurements that made the conclusion unavoidable.
The measurements
| Finding | Figure | Source |
|---|---|---|
| Command injection in tested servers | 43% | Equixly, 2025 to February 2026 |
| File operations prone to path traversal | 82% of 2,614 implementations | Endor Labs |
| SSRF-vulnerable servers | 36.7% of 7,000+ | BlueRock Security, 2026 |
| Servers with no authentication | 24 to 25% | Zuplo State of MCP |
| Servers running on developer machines | 86%; 5% in production | Clutch Security |
| CVEs filed in one 60-day window | 30+, 13 of them command injection | Multiple researchers, early 2026 |
The distribution matters as much as the rates. Eighty-six percent of servers run locally on developer machines, which means the typical MCP server is an unreviewed process on a laptop with the developer's credentials, reachable by whatever the agent was told to read.
What the guidance changes
It gives security teams a document to point at. Authentication in front of every remote server, least privilege per server, audit logging of tool calls and human checkpoints on irreversible actions are now a government baseline rather than a vendor opinion. What it does not do is tell you which servers you have. Registries listed roughly 9,652 records in the official MCP Registry alone in May, and marketplaces list tens of thousands more. The config files that reference them are per agent and per developer.
What to do
- 01Adopt the guidance as your MCP baseline and map each control to an owner.
- 02Build the server inventory from resolver logs, then reconcile against what developers say they use.
- 03Move production MCP servers off laptops into hosts with their own egress policy and authentication.
- 04Scan the servers you keep. Command injection at 43 percent is not a rounding error.