Model Context Protocol (MCP) servers have rapidly emerged over the past year as a widely adopted way to enable Large Language Model (LLM) agents to access dynamic, real-world tools. As MCP servers proliferate and become easy to adopt via open-source releases, understanding their security risks becomes essential for dependable production agent deployments. Recent work has developed MCP threat taxonomies, proposed mitigations, and demonstrated practical attacks. However, to the best of our knowledge, no prior study has conducted a systematic, large-scale assessment of weaknesses in open-source MCP servers. Motivated by this gap, we apply static code analysis to identify Common Weakness Enumeration (CWE) weaknesses and map them to common attack patterns and threat categories using the MITRE Common Attack Pattern Enumerations and Classifications (CAPEC) to ground risk in real-world threats. We then introduce a risk-assessment framework for the MCP landscape that combines these threats using a multi-metric scoring of likelihood and impact. Our findings show that many open-source MCP servers contain exploitable weaknesses that can compromise confidentiality, integrity, and availability, underscoring the need for secure-by-design MCP server development.
Figures & tables
Figure 1: MCP architecture.
Database Name
Number of Elements
Version
CWE
399
4.19.1
CAPEC
615
3.9
Table 1: CWE and CAPEC database details.
Figure 2: Overview of our four-stage framework for analyzing MCP server repositories and computing risk scores.
Figure 3: Likelihood of Exploit distribution.
Figure 4: Number of Impact elements per weakness.
Pos.
Impact
Occurrences
1
Bypass Protection Mechanism
77
2
Read Application Data
73
3
Execute Unauthorized Code or Commands
68
4
Gain Privileges or Assume Identity
67
5
DoS: Crash, Exit, or Restart
58
Table 2: Top 5 Impact elements in the CWE database.
Figure 5: Modes of Introduction distribution.
Figure 6: Likelihood of Attack distribution.
Figure 7: Typical Severity distribution.
CWE
CAPEC Used
Source
Notes
CWE-36
CAPEC-597
CWE-22 (Path Traversal)
Official CWE-to-CAPEC linkage exists (Absolute Path Traversal → CAPEC-597), but CAPEC-597 lacks the required ordinal Likelihood_Of_Attack and Severity fields in the current CAPEC release. We impute these from the parent CWE-22 (Path Traversal), which maps to CAPEC-76/126 with comparable attributes (LA=3, TS=5).
CWE-186
CAPEC-6, CAPEC-15, CAPEC-79
CWE-185 (Incorrect Regex)
CWE-186 (Overly Restrictive Regular Expression) has no official CAPEC mapping. We adopt the three CAPEC patterns from its sibling CWE-185 (Incorrect Regular Expression), which shares the same weakness class, adjusting CC from 2 to 1 to reflect a narrower consequence scope.
CWE-639
—
CWE-22 (Path Traversal)
CWE-639 (Authorization Bypass Through User-Controlled Key) has no official CAPEC mapping. We inherit attribute values from CWE-22, as both involve user-controlled input that bypasses access boundaries (LE=3, LA=3, MI=1, CC=3, TS=5).
CWE-863
CAPEC-114, CAPEC-3
CWE-285 (Improper Authorization)
CWE-863 (Incorrect Authorization) is a child of CWE-285. We inherit the two CAPEC mappings from CWE-285 (Authentication Abuse and Using Leading Ghost Characters) with their original attribute values.
CWE-212
CAPEC-168
Direct mapping
Official CWE-to-CAPEC linkage exists (Improper Removal of Sensitive Information → CAPEC-168), but CAPEC-168 lacks Likelihood_Of_Attack, and CWE-212 lacks Likelihood_Of_Exploit in the current release. We impute both as 3 (High) based on the attack pattern’s description, indicating common exploitability.
Table 3: Manual completion for five CWE classes whose CAPEC mappings are missing.
Figure 8: Frequency of each observed CWE class with bar color indicating the Risk Index derived from CWE-CAPEC metadata.
Figure 9: CWE coverage across tools.
Figure 10: Repository risk versus finding volume.
Figure 11: Percentage share of findings ( Nr% ) and expected exposure ( Rexp% ) attributed to each MCP threat surface.
Figure 12: Distribution of repositories across risk levels.
Figure 13: Conditional co-occurrence of threat surfaces.