One-Third of MCP Servers Are Vulnerable — 492 Have Zero Authentication

The agent skills threat isn't isolated. The infrastructure layer is equally compromised.

The Cloud Security Alliance's March 13 State of Cloud and AI Security report analyzed over 7,000 MCP servers and found 36.7% potentially vulnerable to server-side request forgery (SSRF). Independently, Trend Micro found 492 MCP servers running with zero client authentication and zero traffic encryption. Not weak authentication — none.

This is dual-source convergence from two independent security organizations reaching the same conclusion: the MCP ecosystem's security posture is catastrophically immature. When a protocol designed to give agents access to external systems is deployed without authentication on 7% of servers, and vulnerable to SSRF on 37%, you don't have an ecosystem — you have an attack surface.

The pattern is familiar. Researchers warn it mirrors early OAuth misconfigurations that led to widespread credential theft in 2013–2015. The difference: OAuth protected user accounts; MCP protects agent access to tools, databases, APIs, and infrastructure. A compromised MCP server doesn't leak a password — it gives an attacker the ability to execute arbitrary tool calls through an agent with elevated privileges.

The timing couldn't be worse. MCP adoption is accelerating rapidly — CrewAI 1.10.1 just shipped triple-transport MCP support, and every major agent framework is racing to be "MCP-native." Builders are standing up servers as fast as they can, and security hardening is an afterthought when it's a thought at all.

Minimum viable hygiene: add client authentication to every MCP server today. Enable TLS. Validate all tool inputs against SSRF patterns. If your MCP server is reachable from the public internet without auth, you are running an open relay for agent actions. Stop.