---
title: "Your agent's tools are your new perimeter"
date: 2026-06-03
series: 11
summary: "Every MCP tool you wire into an agent is a new unauthenticated door into your network — and the data says most teams forgot the lock."
voice: judgment
tags: [mcp-security, taint-style-vuln, unauthenticated-tools, agent-attack-surface, tool-poisoning, viper-mcp]
image: "/notes/mcp-server-security/image.png"
imageAlt: "split panel: left \"Exposed MCP\" red (12.5k internet-facing, 106 zero-days, 67 CVEs, no auth); right \"Hardened MCP\" blue (auth gateway, tool allowlist, per-tool creds, audited calls)."
linkedin: null
sources:
  - title: "VIPER-MCP: ~39,884 MCP server repos scanned, 106 confirmed zero-days, 67 CVE IDs assigned — arXiv:2605.21392"
    url: https://arxiv.org/abs/2605.21392
  - title: "~12,520 internet-exposed MCP services, most unauthenticated — Censys, via Adversa AI MCP security roundup"
    url: https://adversa.ai/blog/top-mcp-security-resources-june-2026/
  - title: "NSA published MCP security design-considerations guidance — via Adversa AI roundup"
    url: https://adversa.ai/blog/top-mcp-security-resources-june-2026/
  - title: "Database-MCP flaws (SQL injection, unauthenticated metadata exfil, CVSS 9.8 command injection) — Akamai / Trend Micro disclosures"
    url: https://adversa.ai/blog/top-mcp-security-resources-june-2026/
dateApprox: false
---

Every MCP tool you wire into an agent is a new unauthenticated door into your network — and the data says most teams forgot the lock.

A year into Model Context Protocol, the numbers are ugly. A taint-analysis sweep of ~39,800 open-source MCP servers confirmed 106 zero-days with working exploits and 67 CVE IDs assigned (VIPER-MCP, arXiv). Censys counted ~12,500 internet-exposed MCP services — most with no auth at all. This month the NSA published MCP security design guidance.

**The tool list IS the attack surface.** MCP's whole job is letting a model call your tools — and that same path is taint-style injection: prompt → vulnerable sink → SQL injection, metadata exfiltration, command execution. The model is now an untrusted input source pointed straight at your systems.

**Auth got treated as optional, so teams skipped it.** Unauthenticated metadata exfil and CVSS-9.8 command-injection keep surfacing in DB-connected servers.

So treat every MCP server like the RPC boundary it is: auth in front of all of them, allowlist tools instead of "expose everything", scope credentials per tool, and audit-log every call with the reasoning that triggered it.

**The trap:** the dangerous servers aren't the public ones — they're the internal ones someone stood up with auth off because "it's behind the firewall."

An agent's tools aren't features. They're your new perimeter.