Topic
Security properties and failure modes of Model Context Protocol servers that broker agent access to real systems.
Pasting an mcpServers block into Claude Desktop runs a stranger's code with your environment variables, and the tool descriptions that server advertises land in the model's context before you call anything.
Reality
The author of mcpscan checked rule MCP007 against the year's four MCP path-traversal CVEs, found its sink regex only matched read calls, and closed the gap by adding write sinks that escalate to HIGH on sight.
Reality
Grafana's MCP server checked that a session ID looked like one instead of checking that it had issued it. Paired with a CVSS 9.1 SSRF in the same server, that gave unauthenticated callers a proxy inside the network.
Reality
The oversight ratio comes from one vendor's platform telemetry and should be read as such, but the capability data underneath it is checkable, and half of the 500 MCP servers sampled from npm can execute shell commands.
Reality
One practitioner's design contract for wiring an assistant to cloud cost data: four read tools, no mutate handlers, and a database role that makes the guarantee instead of the prose.
Reality
An open-source Go project puts a JWT-checking gateway and a separate query adjudicator between agents and warehouses. The credential never reaches the model, and neither does the tenant argument.
Reality
A backdoored LiteLLM build was downloaded about 47,000 times in a three-hour window. Most agent incidents never get a CVE, so your scanner dashboard is not the control you think it is.
Reality
Its read-only guarantee is a check that the query text starts with SELECT. Data-modifying CTEs, leading comments and stacked statements all walk straight through it.
Reality