Your agent's tools are your new perimeter

Every MCP tool you wire into an agent is a new unauthenticated door into your network — and the data says most teams forgot the lock.

A year into Model Context Protocol, the numbers are ugly. A taint-analysis sweep of ~39,800 open-source MCP servers confirmed 106 zero-days with working exploits and 67 CVE IDs assigned (VIPER-MCP, arXiv). Censys counted ~12,500 internet-exposed MCP services — most with no auth at all. This month the NSA published MCP security design guidance.

The tool list IS the attack surface. MCP's whole job is letting a model call your tools — and that same path is taint-style injection: prompt → vulnerable sink → SQL injection, metadata exfiltration, command execution. The model is now an untrusted input source pointed straight at your systems.

Auth got treated as optional, so teams skipped it. Unauthenticated metadata exfil and CVSS-9.8 command-injection keep surfacing in DB-connected servers.

So treat every MCP server like the RPC boundary it is: auth in front of all of them, allowlist tools instead of "expose everything", scope credentials per tool, and audit-log every call with the reasoning that triggered it.

The trap: the dangerous servers aren't the public ones — they're the internal ones someone stood up with auth off because "it's behind the firewall."

An agent's tools aren't features. They're your new perimeter.