Widespread Insecure Deployment of Internet-Facing MCP Servers

Technical Analysis

The researchers built Corvus, a dynamic testing framework with 34 modules covering 10 MCP-specific vulnerability classes, and used passive discovery plus active probing against internet-facing MCP servers. Confirmed issues include SQL injection in tool backends, SSRF enabling access to cloud metadata services (a classic pivot to cloud credential theft), path traversal via manipulation of cursor/pagination parameters, and prompt template injection affecting how tool outputs are rendered into LLM context. Critically, 91.8% of audited servers lacked OAuth authentication and 687 tool instances exposed shell execution with no access controls, meaning any network-reachable client (or a compromised/malicious AI agent) could invoke destructive tools or pivot into internal infrastructure. High churn (41.6% of servers disappearing within three days) suggests rapid, ad hoc deployment without security review, which crosses the tool-boundary trust assumption MCP relies on — clients trust that exposed tools are safe and properly scoped, but many are unauthenticated and unsandboxed.

Affected Systems

MCP server implementations discovered via Smithery, glama.ai, pulsemcp.com, npm, PyPI, HuggingFace, GitHub; protocols: MCP

Detection Signatures

• MCP servers responding on public IPs without OAuth/session authentication
• Tool descriptors advertising shell/exec/command-execution capabilities without scope restriction
• SSRF-style outbound requests from MCP tool handlers to 169.254.169.254 or other cloud metadata IP ranges
• Abnormal cursor/pagination parameter values containing path traversal sequences (../, encoded variants)
• Unexpected template-expansion artifacts in tool output injected into LLM context (e.g., unescaped {{}} or Jinja-style tokens)
• SQL error strings or anomalous query timing on tool endpoints accepting user-controlled parameters

Remediation Steps

1. 1

   Enforce authentication on all MCP endpoints

   Require OAuth or equivalent mutual authentication for every internet-facing MCP server; never expose default/unauthenticated transport modes to the public internet.

2. 2

   Restrict and sandbox shell/exec tools

   Remove or heavily gate any tool capable of arbitrary shell execution; run such tools in isolated, least-privilege containers with no outbound network access by default.

3. 3

   Validate and sanitize all tool inputs

   Apply parameterized queries to eliminate SQL injection, strict allow-listing for outbound URLs to prevent SSRF (block link-local/metadata IP ranges), and canonicalize/validate path and cursor parameters against traversal.

4. 4

   Sanitize tool output before LLM context injection

   Treat tool responses as untrusted data; escape or strip template syntax before rendering into prompts to prevent prompt template injection.

5. 5

   Implement deployment security review and monitoring

   Adopt CI/CD gates that scan MCP server configs before publishing to registries (Smithery, npm, PyPI, etc.), and continuously re-scan deployed instances given the high churn/re-deployment rate observed.

6. 6

   Use automated MCP security scanners

   Adopt tools like the open-sourced Corvus framework to proactively test MCP server deployments for the 10 identified vulnerability classes before and after production release.