Model Context Protocol (MCP) servers have rapidly emerged over the past year as a widely adopted way to enable Large Language Model (LLM) agents to access dynamic, real-world tools. As MCP servers proliferate and become easy to adopt via open-source releases, understanding their security risks becomes essential for dependable production agent deployments. Recent work has developed MCP threat taxonomies, proposed mitigations, and demonstrated practical attacks. However, to the best of our knowledge, no prior study has conducted a systematic, large-scale assessment of weaknesses in open-source MCP servers. Motivated by this gap, we apply static code analysis to identify Common Weakness Enumeration (CWE) weaknesses and map them to common attack patterns and threat categories using the MITRE Common Attack Pattern Enumerations and Classifications (CAPEC) to ground risk in real-world threats. We then introduce a risk-assessment framework for the MCP landscape that combines these threats using a multi-metric scoring of likelihood and impact. Our findings show that many open-source MCP servers contain exploitable weaknesses that can compromise confidentiality, integrity, and availability, underscoring the need for secure-by-design MCP server development.
Figures & tables
Figure 1: MCP architecture.
Database Name
Number of Elements
Version
CWE
399
4.19.1
CAPEC
615
3.9
Table 1: CWE and CAPEC database details.
Figure 2: Overview of our four-stage framework for analyzing MCP server repositories and computing risk scores.
Figure 3: Likelihood of Exploit distribution.
Figure 4: Number of Impact elements per weakness.
Pos.
Impact
Occurrences
1
Bypass Protection Mechanism
77
2
Read Application Data
73
3
Execute Unauthorized Code or Commands
68
4
Gain Privileges or Assume Identity
67
5
DoS: Crash, Exit, or Restart
58
Table 2: Top 5 Impact elements in the CWE database.
Figure 5: Modes of Introduction distribution.
Figure 6: Likelihood of Attack distribution.
Figure 7: Typical Severity distribution.
CWE
CAPEC Used
Source
Notes
CWE-36
CAPEC-597
CWE-22 (Path Traversal)
Official CWE-to-CAPEC linkage exists (Absolute Path Traversal → CAPEC-597), but CAPEC-597 lacks the required ordinal Likelihood_Of_Attack and Severity fields in the current CAPEC release. We impute these from the parent CWE-22 (Path Traversal), which maps to CAPEC-76/126 with comparable attributes (LA=3, TS=5).
CWE-186
CAPEC-6, CAPEC-15, CAPEC-79
CWE-185 (Incorrect Regex)
CWE-186 (Overly Restrictive Regular Expression) has no official CAPEC mapping. We adopt the three CAPEC patterns from its sibling CWE-185 (Incorrect Regular Expression), which shares the same weakness class, adjusting CC from 2 to 1 to reflect a narrower consequence scope.
CWE-639
—
CWE-22 (Path Traversal)
CWE-639 (Authorization Bypass Through User-Controlled Key) has no official CAPEC mapping. We inherit attribute values from CWE-22, as both involve user-controlled input that bypasses access boundaries (LE=3, LA=3, MI=1, CC=3, TS=5).
CWE-863
CAPEC-114, CAPEC-3
CWE-285 (Improper Authorization)
CWE-863 (Incorrect Authorization) is a child of CWE-285. We inherit the two CAPEC mappings from CWE-285 (Authentication Abuse and Using Leading Ghost Characters) with their original attribute values.
CWE-212
CAPEC-168
Direct mapping
Official CWE-to-CAPEC linkage exists (Improper Removal of Sensitive Information → CAPEC-168), but CAPEC-168 lacks Likelihood_Of_Attack, and CWE-212 lacks Likelihood_Of_Exploit in the current release. We impute both as 3 (High) based on the attack pattern’s description, indicating common exploitability.
Table 3: Manual completion for five CWE classes whose CAPEC mappings are missing.
Figure 8: Frequency of each observed CWE class with bar color indicating the Risk Index derived from CWE-CAPEC metadata.
Figure 9: CWE coverage across tools.
Figure 10: Repository risk versus finding volume.
Figure 11: Percentage share of findings ( Nr% ) and expected exposure ( Rexp% ) attributed to each MCP threat surface.
Figure 12: Distribution of repositories across risk levels.
Figure 13: Conditional co-occurrence of threat surfaces.
The Model Context Protocol (MCP), introduced by Anthropic in November 2024 and now governed by the Linux Foundation's Agentic AI Foundation, has rapidly become the de facto standard for connecting large language model (LLM)-based agents to external tools and data sources, with over 97 million monthly SDK downloads and more than 177000 registered tools. However, this explosive adoption has exposed a critical gap: the absence of a unified, formal security framework capable of systematically characterizing, analyzing, and mitigating the diverse threats facing MCP-based agent ecosystems. Existing security research remains fragmented across individual attack papers, isolated benchmarks, and point defense mechanisms. This paper presents MCPSHIELD, a comprehensive formal security framework for MCP-based AI agents. We make four principal contributions: (1) a hierarchical threat taxonomy comprising 7 threat categories and 23 distinct attack vectors organized across four attack surfaces, grounded in the analysis of over 177000 MCP tools; (2) a formal verification model based on labeled transition systems with trust boundary annotations that enables static and runtime analysis of MCP tool interaction chains; (3) a systematic comparative evaluation of 12 existing defense mechanisms, identifying coverage gaps across our threat taxonomy; and (4) a defense in depth reference architecture integrating capability based access control, cryptographic tool attestation, information flow tracking, and runtime policy enforcement. Our analysis reveals that no existing single defense covers more than 34 percent of the identified threat landscape, whereas MCPSHIELD's integrated architecture achieves theoretical coverage of 91 percent. We further identify seven open research challenges that must be addressed to secure the next generation of agentic AI systems.
Nirajan Acharya, Gaurav Kumar Gupta
University of the Cumberlands · Youngstown State University
The Model Context Protocol (MCP) has seen rapid adoption since its November 2024 launch, with over 21,000 server instances detectable on the public internet. We present the first dynamic behavioral security assessment of internet-facing MCP servers, combining passive discovery across eleven data sources (crt.sh, HuggingFace, GitHub, npm, Smithery, PyPI, Censys, FOFA, Shodan, glama.ai, and pulsemcp.com) with active dynamic testing using Corvus, a purpose-built framework implementing 34 test modules covering 10 MCP-specific vulnerability classes. Across four measurement runs spanning July 2026, we confirm 640 production MCP servers and dynamically audit 414, uncovering 68 reportable vulnerabilities including SQL injection, SSRF targeting cloud metadata services, prompt template injection, and path traversal via cursor manipulation. We find that 91.8% of dynamically audited servers lack OAuth authentication, 687 tool instances across confirmed servers expose shell execution capabilities without access controls, and 41.6% of confirmed servers disappear within three days between consecutive measurement runs---indicating rapid deployment cycles without security review. We report on our responsible disclosure pipeline and release Corvus as an open-source framework for MCP security evaluation.
The rapid proliferation of Model Context Protocol (MCP)-based agentic systems has introduced a new category of security threats that existing frameworks are inadequately equipped to address. We present MCPThreatHive, an open-source platform that automates the end-to-end lifecycle of MCP threat intelligence: from continuous, multi-source data collection through AI-driven threat extraction and classification, to structured knowledge graph storage and interactive visualization. The platform operationalizes the MCP-38 threat taxonomy, a curated set of 38 MCP-specific threat patterns mapped to STRIDE, OWASP Top 10 for LLM Applications, and OWASP Top 10 for Agentic Applications. A composite risk scoring model provides quantitative prioritization. Through a comparative analysis of representative existing MCP security tools, we identify three critical coverage gaps that MCPThreatHive addresses: incomplete compositional attack modeling, absence of continuous threat intelligence, and lack of unified multi-framework classification.