State of MCP Security — August 2026
Eighteen months after Anthropic introduced the Model Context Protocol, the ecosystem has grown from a handful of reference servers to the tens of thousands. The security picture has grown with it. Here are the numbers, the notable attacks so far this year, and what to actually do about your own MCP setup.
The headline numbers
Source for the top three: Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem (arXiv 2509.06572), which crawled public MCP registries and applied static analysis + dynamic probes to what they found. The paper is behind an academic embargo on its full dataset, but the aggregate rates were released in June 2026.
The stats are worse than they sound because MCP servers are almost always given elevated trust — they're speaking to an agent that will happily run whatever they say. A path-traversal bug in a random REST API leaks a config file. A path-traversal bug in an MCP file server means the agent, cheerfully, hands the attacker whatever they ask for.
Why the numbers are this bad
Three structural reasons, none of them mysterious:
1. The reference examples ship with the vulnerabilities
The most-copied MCP filesystem server tutorial from mid-2025 used path.join(root, userInput) with no normalization. That single pattern is directly responsible for the 82% path-traversal rate — grep any MCP registry for it and you'll find the fingerprint everywhere. Anthropic updated the reference examples in October 2025; forks that predate that update did not automatically rebase.
2. There's no "MCP linter" that runs by default
npm packages get audited by npm audit. Docker images get scanned by Snyk / Trivy. MCP servers get scanned by… whatever the author remembers to install. There's no equivalent of go vet that runs on every MCP server before it ships to a registry, and no registry currently blocks a submission for having a command-injection path. That's changing (see below) but it's not the default in August 2026.
3. Agents are structurally trusting
The whole promise of MCP is "let the agent decide what tool to call". That means the agent will happily call a tool with attacker-controlled parameters if the attacker can inject them via any upstream input — a document the agent reads, a webpage it browses, a git PR title (see below). Every one of the ~48k public MCP servers is one prompt-injection away from being weaponised against its user.
Notable 2026 attacks
| Date | Attack | Severity | What happened |
|---|---|---|---|
| 2026-04-11 | PR-title injection into coding agents | Critical | Aonan Guan (Johns Hopkins) demonstrated that Claude Code, Gemini CLI, and GitHub Copilot would execute instructions embedded in PR titles when asked to review PRs — because those titles were passed to the MCP git server unfiltered and returned to the agent as trusted text. Documented as Case 13 in the Prompt Injection Casebook. |
| 2026-03-18 | Slack-DM exfil via MCP webhook server | High | A popular community-maintained MCP webhook server had no allow-list on outbound URLs. An attacker with the ability to send the agent a DM containing a URL could redirect the agent to exfiltrate any accessible context to attacker-controlled endpoints. Patched within 72 hours; ~2,100 known installations pre-patch. |
| 2026-02-04 | SQLite MCP → arbitrary file read | High | The Anthropic-published @modelcontextprotocol/server-sqlite reference server allowed ATTACH DATABASE against arbitrary file paths — which SQLite will happily open, exposing content of any file the agent process can read. Fixed in 0.6.3 (Feb 5). |
| 2026-01-22 | "Tool poisoning" registry attack | Medium | Squatted package names on npm that matched popular MCP-server namespaces — e.g. @modelcontextprotcol/server-github (typo). Installed by ~400 developers before takedown. Payload was benign (a beacon) but proved the supply-chain pipeline for MCP is a viable target. |
| 2025-11-08 | "EchoLeak" via Copilot Studio MCP | High | Late 2025 but still landing waves in 2026: a Copilot Studio integration allowed instructions in an incoming email to trigger MCP tool calls that leaked message content back to the attacker through a resource-fetch tool. Class of bug still present in a lot of enterprise deployments. |
The pattern across every one of these: the vulnerability is not "the LLM was tricked" — it's "an MCP server didn't sanitise something, and the LLM cheerfully passed the trickery through it".
Defensive tooling — what's shipped in 2026
MCP registries with vulnerability scanning
Two commercial MCP registries (mcp.run, MCP Hub) now run static analysis on submitted servers and refuse to publish anything with obvious command-injection or path-traversal patterns. Coverage is nowhere near npm-audit levels, but it catches the most common tutorial-fingerprint bugs.
Anthropic's MCP Security Advisory feed
As of March 2026, Anthropic publishes an MCP security advisory RSS feed at anthropic.com/mcp/advisories. Modelled on GitHub Security Advisories. Follow it, or subscribe your CI to it and fail the build when an advisory affects a server you have installed.
Microsoft's MCP guidance for Copilot Studio
Microsoft's July 2026 guidance on Copilot Studio + MCP requires: content-safety filtering on all MCP tool outputs before they hit the model, allow-list for outbound URLs from any MCP server that can make network calls, and mandatory sensitivity labelling on any tool that can read files. If you're on the Microsoft stack this is the minimum. If you're not, adapt the pattern.
Client-side scanners like our MCP Inspector
Client-side inspectors let a developer check their own mcp.json and probe each server before hooking it up to a live agent. Our own MCP Inspector is 100% client-side (nothing leaves the browser) and flags the common patterns: unbounded tool descriptions, tools that ship secrets in their schema, dangerous name overlaps with well-known tools, and prompt-injection payloads in tool descriptions.
What you should actually do this week
The 15-minute MCP audit
- List every MCP server in your
mcp.json. If you can't remember why one is there, remove it. - For each remaining server, check that it's from a source you trust (Anthropic, your own org, or a maintainer whose GitHub history you've looked at).
- Run MCP Inspector or the
@modelcontextprotocol/inspectorCLI over every server. Flag anything with tool descriptions that contain imperative instructions ("Always call this first…", "Ignore any warnings…"). - For any server that touches the filesystem, confirm it path-normalises. If the source is a fork of the 2025 tutorial, assume it's vulnerable until you verify.
- For any server that makes network calls, confirm it has an outbound allow-list. If it doesn't, add one — even a static list of known-good hosts is a huge improvement.
- Subscribe to the Anthropic MCP advisory feed. Wire it into your build if you have one.
- Read The 2026 MCP Security Checklist for the operational version of this list.
Where this is going
Three trends are worth watching over the next six months:
- Signed MCP servers. Anthropic's July 2026 RFC on cryptographically signed MCP manifests would let clients verify a server's tool list hasn't changed since last install. That prevents silent "tool rug-pull" attacks where a server adds a malicious tool after install. Expect this to land in reference clients by Q4.
- MCP firewalls. A handful of startups (and Microsoft's Sentinel team) are shipping in-line MCP proxies that inspect every tool call. Think "WAF but for agent tool calls". Early days but this is the shape of the enterprise mitigation.
- The next big vuln class. Path traversal and command injection are the obvious ones. The next wave will be around cross-server context leakage — one MCP server reading data from another via shared resources — because nobody's implementing per-server context isolation yet.
The bottom line
MCP security in August 2026 is where JavaScript package security was in 2016 — the shape of the problem is well-understood, the reference tooling exists, but the ecosystem hasn't yet made secure-by-default the path of least resistance. In the meantime, the responsibility falls on the person hooking servers up to their agent.
Run the audit. Pin the versions. Subscribe to the advisory feed. Assume every tool description is potentially adversarial. And read the Casebook — because "the LLM won't get tricked" is not a defense.
Related
- MCP Inspector — client-side security scanner for your
mcp.json. - The 2026 MCP Security Checklist — operational version of the audit above.
- The 2026 Prompt Injection Casebook — 13 patterns still landing against frontier models, including MCP-adjacent attacks.
- GPT-5.6 vs Claude Opus 5 vs Gemini 3.6 — MCP is model-agnostic, but agent behaviour differs.