The ten security risks specific to Model Context Protocol servers. Six of them can be tested from outside your server, and those six have a page here explaining the attack and a scanner behind it.
Paste a server URL for a free, unauthenticated scan — 27+ checks, graded report, no sign-up.
The free scan only sees what an anonymous caller sees. Authenticated and agentic depth lives in the dashboard scanner.
Each page covers how the attack actually works, a concrete example, the checks that detect it, and — stated plainly — what an external scan cannot establish.
A tool description is not documentation — it is text written by whoever runs the server, delivered straight into your model's context. If it contains instructions, the model follows them.
The least exotic risk on the list and the one that actually shows up. Most exposed MCP servers are not subtly flawed — they answer tools/list to anyone who asks.
The classic vulnerability with a new delivery mechanism. What is different about MCP is not the bug — it is that you have attached an eager, creative, tireless agent to the input field.
Your server is not compromised. Your tool works exactly as designed. It fetches a document, returns the contents — and the contents were written by someone who wanted to talk to your agent.
Nobody exfiltrates a token from a hardened vault. They read it out of an error message that was trying to be helpful, in a response nobody thought of as output.
Every tool passes review individually. The problem only exists in the combination — one tool that reads what matters, another that can send, and one context holding both.
These four are real risks, but none of them can be answered by probing a URL. Two are governance questions about your organisation rather than properties of a server, and two have no detector here yet. We would rather say so than publish a page that restates the OWASP definition and calls it coverage.
Loosely defined permissions expand over time, granting agents excessive capability. Weak scope enforcement or missing audience binding enables unintended repository, system, or data access.
No external detector yet. A page will follow when there is something real to test.
A compromised dependency or tampered tool definition can alter agent behaviour or introduce execution-level backdoors. We detect the observable symptom — a tool definition that changed since its trusted baseline (a rug pull).
No external detector yet. A page will follow when there is something real to test.
Limited telemetry impedes investigation and incident response. Maintain detailed, immutable logs of tool invocations, context changes, and user-agent interactions.
Self-certified in the dashboard scanner — not observable from outside the server.
Unapproved MCP deployments operating outside formal security governance — spun up for convenience, often with default credentials or permissive configs. Shadow IT for MCP.
Answered from your org’s known-server inventory, not from a scan.