Write-capable MCP tools jumped from 27% to 65%

MCP tool calls now mostly write instead of read, per a new attack-surface survey of MCP, Skills, and tool calling. The write-capable share of deployed tools climbed from 27% to 65%, the survey found.

For anyone running a write-capable agent, the safety net is thin. Measured protections stop fewer than 30% of attacks, and model-level refusal, the built-in behavior that's supposed to catch a bad instruction, catches under 3%.

Applied to blockchain execution, four properties turn a recoverable mistake into a permanent loss: irreversibility, signing authority, continuous autonomy, and sequence-level composition.

The gap isn't specific to crypto. The same math applies to any write-capable MCP server, whatever domain it serves.

Model-level refusal is doing almost none of the protective work here, while write access nearly tripled. Watch whether teams start gating tool calls with deterministic checks, signing limits, and irreversibility confirmations instead of trusting the model to say no.

The finding surfaced in coverage dated August 19, as MCP and Skills push more deployed tools toward write access instead of read-only queries.