Audit Finds 2,259 Exploitable Bugs Across 9,695 MCP Servers

An audit flagged 5,832 of 9,695 MCP servers for security issues, per GBHackers. Of those, 2,259 held exploitable bugs that go past a missing login check: arbitrary file access, command injection, SSRF, SQL injection. That's close to a quarter of every server the researchers pulled from popular directories.

The audit's other finding should change your shopping list: stars, commit activity, and verification badges did not reliably correlate with security posture. Those are the exact signals most developers use to decide which server to trust.

A separate framework, MCPPrivacyDetector, checked more than 10,000 real-world servers and found credentials, API keys, and personal data leaking at rates above 10%. Two different methodologies landed on the same conclusion: the ecosystem shipped fast and skipped the step where someone checks what these servers can touch.

The audit doesn't say which directories carry the worst servers, or whether the 2,259 exploitable ones cluster in file-system or database connectors. Until that breakdown exists, I'd read the source of any server before installing it, badge or no badge.

A related report this cycle found permission systems failing open at the parser layer instead of the policy layer. Same root problem: nobody's checking what the code can actually do before access is granted.