Flagship research
The State of MCP Server Safety
EDITION 2026 · PUBLISHED 2026-08-09
Most tested MCP servers carry serious, unaddressed security issues — command injection, path traversal, and SSRF are each present in a large share of the ecosystem, and the open-source scanners built to catch them run false-positive rates high enough to be unusable at scale.
Vulnerability prevalence
| Finding | Detail | Source |
|---|---|---|
| 43% | of tested MCP servers are affected by command-injection vulnerabilities. | 2026 audit data |
| 82% | use file operations prone to path traversal. | 2026 audit data |
| 36.7% | of 7,000+ servers scanned are vulnerable to server-side request forgery (SSRF). | Large-scale scan |
| ~5.5% | tool-poisoning prevalence, measured across 1,899 servers. | Academic study |
Grading gaps
| Finding | Detail | Source |
|---|---|---|
| 71% F / 0% A | of servers scored an F in an independent audit of 100 packages — zero scored an A, including reference implementations from Anthropic and Microsoft. | Audit of 100 packages |
Scale of exposure
| Finding | Detail | Source |
|---|---|---|
| 106 / 67 | zero-days and CVEs found across roughly 40,000 server repositories. | VIPER-MCP static+dynamic framework |
| 41% | of servers in the official MCP registry run with zero authentication. | Large-scale scan, 2026 |
| 40+ / ~200K | CVEs filed against MCP in the first four months of 2026 alone — about one every four days — including a single April advisory covering 10 high/critical CVEs across an estimated 200,000 vulnerable servers. | Ox Security advisory, 2026 |
Scanner reliability
| Finding | Detail | Source |
|---|---|---|
| ~78% | measured false-positive rate from existing YARA-based MCP scanners — the reason aimcplist measures and publishes its own rate rather than assuming the incumbents' tooling is trustworthy. | Independent audit |
Further reading
For what these attack patterns actually look like in an MCP context, see the concept explainers: tool poisoning, rug pulls, and SSRF in MCP.