MCP goes stateless HTTP. Your agents just gained a lot more remote servers.

The Model Context Protocol's 2026-07-28 specification, circulated as a release candidate in May, moves the protocol core to stateless HTTP and adds an extensions framework, tasks, MCP Apps and authorization hardening. The practical effect is the one every platform team felt immediately: remote MCP servers became dramatically easier to deploy, and an organization may have a dozen running before its security controls notice.

What the scans found

Censys found 12,520 internet-accessible MCP services, most of them unauthenticated, many exposing database-query and command-execution capabilities to anyone who connects. Trend Micro's follow-up scan counted 1,467 exposed servers and reported CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers. Akamai disclosed SQL injection in the Apache Doris MCP server, an unauthenticated metadata-exfiltration flaw in Alibaba's RDS MCP, and a potential takeover in Apache Pinot's MCP; one of the three vendors declined to patch. In June, CISA and NSA issued joint guidance calling MCP an emerging attack surface.

Why it matters

An MCP server is a hostname with credentials behind it. It makes outbound calls on behalf of every agent that uses it, and its tool descriptions enter the model's context with instruction-level authority before anyone reviews them. When servers were local processes on developer laptops, the blast radius was one machine. Stateless HTTP puts them on the network, where a poisoned or misconfigured server serves every agent in the organization.

The single highest-impact move for MCP is the dullest one: put authentication in front of every remote MCP server and take the unauthenticated ones off the public Internet.

What to do

1. 01Authenticate every remote MCP server. Unauthenticated servers reachable from the internet come down today.
2. 02Run MCP servers in their own namespace or host with their own egress policy, separate from the agents that call them.
3. 03Inventory MCP server hostnames from the resolver rather than from config files; the config files are per agent and incomplete.
4. 04Treat tool descriptions as untrusted input. Re-approve when a server's tool set changes.