MCP Server Risk in GenAI Workloads

The exploit isn’t coming for the model – it’s coming through it.

Most GenAI deployments don’t just process language – they execute it. Behind every prompt that reads a file, fetches a URL, or updates a record sits a Model Context Protocol (MCP): a backend that gives large language models (LLMs) access to tools, memory, and the power to act on live infrastructure.

MCPs are what turn chatbots into agents. And while usage is exploding, so is that attack surface: They’re rapidly emerging as the most exposed layer in AI infrastructure. Unlike conventional backends or APIs, MCPs operate through dynamic, probabilistic reasoning flows. A model can pivot from summarizing a document to modifying a database, to triggering downstream tools – all inside the same session. That means every exposed tool is a potential exploit vector.

To understand the real-world risk exposure, Securin analyzed 36 live MCP deployments. What we found: The execution layer of GenAI is dangerously undefended. The breach path is evolving – and it’s using your tools to walk in through the front door.

1. Tool Misuse is The Dominant Threat Vector for MCPs

When people think about AI security, they still think of prompt injection, like clever text strings and jailbroken personalities. Those threats are real but, increasingly it’s not where the breach begins. Our research shows that, of 36 active MCPs, 34 were critically exposed – not through their prompts, but through the tools the models are allowed to call. And that’s a significant shift.

34 out of 36 MCP services scored ≥  8/10 on tool-threat risk.

This is not a theoretical issue. Some of the risks we detected include:

• Unrestricted shell execution via subprocess calls.

• Misleading or mutable tool descriptions (aka “rug pulls”).

• Excessive file and network permissions.

• Path traversal and unsanitized input routes.

This represents a pivot in the GenAI exploit landscape. These aren’t rogue shell scripts or shadow APIs. They’re legitimate functions - like file readers, subprocess runners, or HTTP fetchers. The model isn’t exploited despite these tools – it’s exploited because of them.

What we’re observing here is pathogenic execution logic: a prompt that flows clearly through a valid reasoning chain, and lands in a tool that wasn’t hardened. No need for the attackers to crash through, the logic rides the wave all the way to an over-permissioned tool call.

TL;DR: The danger is no longer what the model says, it’s what it’s allowed to do.

2. Protocol Vulnerabilities are Widespread and Structurally Embedded

Protocol-level risks scored Critical in 16 out of 36 servers – 44% – contributing to most of the 760 agentic findings across the scan. These are weaknesses not in language models or AI logic, but in the ‘connective tissue’ that binds them to the outside world. To security professionals, the issues we observed are classic - but newly dangerous in an agentic context:

• Token leakage and weak auth defaults.

• Missing HMAC/integrity controls on payloads.

• URL-based session identifiers leaking via logs.

• Server-to-server SSRF capabilities with no guardrails.

Crucially, we found a negative correlation (ρ ≈ -0.22) between protocol risk and overall score. What does that mean? Some systems maintain a moderate composite score, despite serious protocol flaws – often thanks to strong tool isolation or secrets management. These systems can look defensible, but at the network edge, they’re exposed.

TL;DR: Protocol threats are baked into the architecture, and because they don’t always spike overall scores, they’re easy to miss – until someone strolls through.

3. Five Servers Account for Almost A Third of All Critical and High-risk Findings

One of the most revealing findings in our dataset: five MCPs accounted for 32% of all critical and high-severity findings. A handful of over-permissioned, under-patched nodes – 14% of the overall fleet – are carrying a disproportionate share of exposure. And these are the ones an attacker will find first.

The high-risk group included services with consistently elevated scores across multiple categories, such as tool-threats at or near maximum, coupled with protocol weaknesses and recurring CWE patterns such as improper input validation (CWE-20) and information exposure (CWE-209).

To add to the challenge, the operational impact is also measurable. Risk correlates cleanly with workload. An MCP scoring ≥8/10 generates ~6.2 remediation tickets on average. This matters for planning, and means composite scoring isn’t just a security health indicator, it’s a predictor of operational burden. Addressing the top five highest-scoring services could deliver a substantial reduction in both security exposure and the volume of patch or mitigation work required across the fleet.

TL;DR: Five MCP services – less than 14% of the fleet – account for almost a third of all critical and high-severity issues. With a strong link between high composite scores and ticket volume, targeting the top offenders could pay off in both security and operational terms.

4. Traditional Web Flaws Still Dominate AI Infrastructure

MCPs and agentic AI systems might be new, but the vulnerabilities showing up in our analysis are anything but. The most common weaknesses across the 36-server fleet were long-established web application flaws – now embedded in AI execution paths:

CWE-20 - Improper Input Validation: 71 occurrences. Found where unchecked user input flows directly into tool logic, creating the potential for injection, traversal, or unsafe execution.

CWE-400 - Excessive Resource Consumption: 48 occurrences. Risk surfaces included unbounded payload sizes and unrestricted loop or fetch operations - still unmitigated in many @mcp.tool implementations.

CWE0209 - Information Exposure: 48 occurrences. Instances where sensitive data, tokens, or internal details were exposed in logs or error responses.

These aren’t speculative categories, they were flagged repeatedly by the scanner, and in some cases appeared in multiple tools within the same MCP service. That recurrence points to structural control gaps: missing centralized validation utilities, no global rate-limiting and inconsistent logging sanitization.

The security implications are clear: Even as the operational layer shifts from web forms and API endpoints to AI-driven tool calls, the underlying weaknesses remain the same. But now they’re executing in environments with broader reach – where a single unchecked input can lead directly to a privileged system action.

TL;DR: CWE-20, CWE-400 and CWE-209 – decades-old web flaws – topped our MCP vulnerability list, with 167 combined occurrences. AI infrastructure isn’t replacing traditional weaknesses, it’s replaying them inside more capable, higher-impact systems.

5. Tooling Discrepancies Matter – Use Both ASPM and Agentic Scanning

Our scan result showed clear divergence between agentic analysis tools and Application Security Posture Management Platforms (ASPM) – not in terms of accuracy, but in the surfaces they cover. Across the 36 MCP services:

• Agentic analysis detected 107 critical and high-severity issues.

• ASPM scanning flagged 16 issues, with 89% rated medium, and only 3 critical findings.

The difference isn’t a false positive / false negative problem – it’s a coverage gap by design. Agentic scanning consistently uncovered logic-level flaws in the MCP tool layer and protocol surfaces: improper input handling, excessive permissions, missing payload integrity checks. ASPM tools excelled at identifying infrastructure and runtime risks, such as stale container images, vulnerable third-party packages, and exposed secrets.

What does this mean? The two are orthogonal, not redundant. Relying on one over the other risks leaving half of the attack surface unexamined – and the unexamined half may not even show up in your current risk dashboard at all.

For security teams, this takeaway is operational: triage budgets, SLAs and alerting rules must reflect what each tool can and cannot see. Treating them as interchangeable leads to blindspots that adversaries can – and will – exploit.

TL;DR: Agentic analysis flagged over 6x more critical/high issues than ASPM – but ASPM surfaced runtime and infrastructure risks that agentic tools missed. They cover different surfaces – plan remediation accordingly.

6. Infrastructure Hygiene is Uniform – But Weak

When we looked beyond MCP logic and protocol layers to the supporting infrastructure, a different pattern emerged: uniformity.

Every service in the 36-server fleet scored in the medium (2-4.9) range for both container image CVEs and third-party package vulnerabilities (SCA). The average risk scores were almost identical:

• Container: 2.63 / 10

• SCA: 2.62 / 10

This suggests a shared release and maintenance process governing both layers. On the down-side: When that process slips, both surfaces degrade in lock-step. A closer look at the ASPM findings revealed one of the main drivers:

41% of flagged container images were tagged :latest - but were more than 90 days old.

The :latest tag creates a false sense of freshness, masking the fact that base images haven’t been rebuilt or patched against newly disclosed CVEs. In regulated or high-assuance environments, this can translate directly into compliance violation.

TL;DR: Infrastructure hygiene may not dominate the risk profile the way tool threats do, but it is the baseline everything else rests on. Without reliable patch cadence for both base images and dependencies, MCP deployments will accumulate silent technical debt that security dashboards may under-prioritize.

What Needs to Change. Now.

Our research reflects very real vulnerabilities in live MCP deployments - the systems now powering parts of government, critical infrastructure, financial services and other regulated sectors. These are the exact conditions under which GenAI infrastructure is failing under production loads and the patterns are clear: over-permissioned tools, exposed protocols, recurring CWE patterns, stale images. They’re not edge cases, and they’re not going away without changes in how we build, scan and maintain these systems.

Agentic Threat Score Heatmap Across Mcp Fleet

If you’re building and/or regulating AI systems, here’s where to start:

Treat MCPs as first-class infrastructure

Not extensions, not plug-ins. These are execution surfaces, and they deserve the same network boundaries, scanner coverage and policy oversight that you apply across other systems.

Constrain the tool layer

Enforce allow-lists. Sanitize inputs. Sandboxing isn’t an option if the tool can touch disk, shell or socket.

Use dual scanning as baseline

Agentic+ASPM, tuned to different surfaces. If you’re only using one, consider what it’s not catching.

Track exploit patterns, not just point CVEs

CWE clustering tells you more about systemic weakness than any one alert – start tracking lineage.

Kill :latest in CI/CD

Use immutable tagged, verified images, and age-audit everything. Assume drift unless you’ve proven otherwise.

AI is a System. Secure It Like One.

Tomorrow’s breaches won’t just be rogue LLMs spouting unfiltered responses. They’ll come from legitimate tools, operating as intended, under the wrong assumptions. That’s not a bug in the model, it’s a breach in the logic layer – and it’s already here. Our research is a snapshot of where the real danger is showing up in production. If you’re securing AI networks, this is where you need to look next. Because the danger is no longer just in what the model says, it’s in what it’s allowed to do.

Ready for more? Learn more about Securin’s approach to securing the future of GenAI with the NAVIGATE Framework.