5,618 MCP Servers Scanned: 90% Unverified, 36.7% SSRF-Exposed, 37% Zero Auth

The Model Context Protocol has a security problem, and now we have numbers to prove it. An independent scan of 5,618 public MCP servers found that only 143 — that's 2.5% — scored green on a basic security assessment. The remaining 5,067 servers (90%) flagged yellow for stale dependencies or insufficient metadata. Among servers that accept external URLs, 36.7% expose Server-Side Request Forgery vectors capable of reaching AWS instance metadata endpoints for full cloud account takeover. Of 539 active production endpoints, 201 (37.4%) require zero authentication. Source

These aren't exotic AI-specific vulnerabilities. The specific weak points are embarrassingly familiar: FAISS with arbitrary file read/write via crafted index files, TorchServe with RCE via SnakeYAML, and Ollama with stored SSRF from inadequate URL validation. This is 2010-era web security debt repackaged as cutting-edge agent infrastructure.

A separate BlueRock analysis of 8,000+ servers corroborates the same 36.7% SSRF figure and adds CWE classifications, publisher reputation scores, and AI governance framework mappings through their new MCP Trust Registry. Meanwhile, OWASP formally published a Top 10 vulnerability list specifically for MCP — the first formal security taxonomy dedicated to the protocol. The root causes map cleanly to conventional web vulnerability classes, not novel AI vectors.

And a third independent study found 118 vulnerability findings across 68 MCP server packages at the code level, distinct from the network-level scans above.

The takeaway is uncomfortable: the protocol everyone is wiring into their agent pipelines this month carries the security posture of a pre-OWASP-era PHP application. If you're connecting MCP servers to anything with credentials, you need a pre-connection audit — not after your first incident.