As of August 2026
MCP did not begin as an unauthenticated internet service. It began as a local protocol where stdio processes inherited trust from one machine. The exposure appeared when that trust model moved to HTTP without an equivalent identity boundary.
The fix needs defense at the gateway and at each server. A gateway that can be bypassed is routing, not enforcement.
Confirmed servers
640
the July study identified production MCP servers exposed on the public internet.
Dynamic sample
414
the researchers tested this subset rather than treating every discovered endpoint as equivalent.
No OAuth
91.8%
the reported rate applies to the dynamically audited sample, not all discovered servers.
Local trust traveled farther than intended
The MCP specification treats authorization as optional and distinguishes HTTP from stdio. A local stdio server can use environment-provided credentials inside an existing process boundary. Put the same server on a reachable HTTP endpoint and that inherited boundary disappears. The tool may still execute with broad local privileges while the caller has no verified identity.
The payment analogy has two layers
Card systems hardened endpoints through EMV, injected keys, and point-to-point encryption. They also centralized routing, risk, and audit through acquirers and networks. Agent tools need the same split. Each server validates the caller and scope. A broker or gateway applies shared identity, policy, rate, routing, and audit controls across the fleet.
Central policy reduces inconsistency. Server-side validation prevents the gateway from becoming a single bypass point.
The gateway becomes useful when it knows the protocol
The July 2026 specification added protocol headers that can help gateways identify and route MCP traffic without parsing every body. Cloudflare’s August update showed the same direction through MCP traffic detection and enforcement. That is the start of a control plane, but detection alone doesn’t create identity or least privilege.
Every tool call needs an authenticated principal, server and method scope, policy decision, request identifier, outcome, and audit record. Shell and file tools need narrower execution identities than the host process. Secrets should stay in the server boundary and never travel through prompts or tool arguments. Network policy should prevent direct access that bypasses the broker.
The tool server validates authority. The gateway applies shared policy. Security fails when either side assumes the other one did both jobs.
