The MCP security audit no one asked for but everyone needs

Anthropic’s Model Context Protocol was supposed to be the universal adapter for AI agents. Standard way to connect Claude or GPT to your database, your filesystem, your Slack. The State of MCP Security 2026 report audited thirty-seven public MCP server implementations and found something predictable: most of them treat security as optional. The numbers are blunt. Sixty-two percent ship with authentication disabled by default. Forty-one percent have no rate limiting at all. Seventeen implementations let you read arbitrary files if you know the path. The filesystem server, the one everyone copies when they start building, has a config flag for sandboxing. The default is off. This is not a protocol design flaw. MCP has OAuth support, scope definitions, the whole IETF-approved stack. The problem is that reference implementations optimise for demo speed, not production safety. You clone the repo, run npm start, and suddenly your LLM can cat /etc/passwd because no one told it not to. The report recommends three things. One, make auth mandatory in the spec, not a nice-to-have. Two, ship working examples with real OAuth flows, not TODO comments. Three, add a security checklist to the MCP docs that library authors actually read. I have seen this pattern before. Every protocol that starts as a research demo eventually gets deployed in production by someone who skipped the hardening chapter. The gap between “it works in the notebook” and “it works when the internet can reach it” is where all the CVEs live. MCP will get there. The audit is public, the fixes are obvious, and Anthropic moves fast when reputation is on the line. But if you are running an MCP server right now, go check your auth config. The default is probably wrong.

---

Source: The State of MCP Security pdf