36.7% of scanned MCP servers are exposed to SSRF, 42% leak credentials

BlueRock scanned over 7,000 MCP servers against 22-plus security rules. 36.7% carry potential server-side request forgery exposure from unrestricted outbound fetch, and 42% handle credentials insecurely. Their worked example is Microsoft's 85K-star Markitdown MCP server and its unbounded-fetch pattern. Source.

This is the finding that turns "MCP is risky" from a vibe into a number. We've spent months hand-waving about agent security. BlueRock put a denominator under it. Better than a third of the servers agents are connecting to right now will happily fetch whatever URL you feed them, which means an attacker who can influence a tool's input can make your agent reach into your internal network, hit your cloud metadata endpoint, and pull back secrets. SSRF is a 15-year-old bug class. It just got a new delivery mechanism that ships with an eager autonomous client attached.

And it's not theoretical this week. Unit 42 caught live campaigns hiding agent instructions in HTML body, JSON-LD, Open Graph tags, and off-screen CSS to trick browsing agents into sending crypto payments, with 4 of 26 tested models failing to act safely. Source. Sysdig documented JADEPUFFER, an LLM agent that drove an entire ransomware intrusion through a vulnerable Langflow instance. Source. The MCP exposure BlueRock measured is the static surface. Those two are the surface being actively worked.

What to do, concretely. Pin your MCP server dependencies. Bound every outbound fetch to an allowlist. Treat any tool that fetches a URL as an SSRF liability by default, not after an incident. If you run Markitdown or anything like it, put it behind egress controls that can't reach [redacted] or your internal ranges. And stop trusting URL-resolving tools with the same casualness you'd trust a pure-compute tool. The composability that makes MCP great is exactly the property that makes a compromised server a pivot point into everything the agent can touch. We solved this in web apps with egress filtering and SSRF guards years ago. The agent ecosystem is speedrunning the same mistakes with a bigger blast radius.