Show HN: We scanned 23 public MCP servers for CVEs - Here is what broke

Neon Innovation Lab — Fri, 04 Sep 2026 11:21:33 +0000

With tens of thousands of Model Context Protocol (MCP) servers published in 2026, AI agents now have direct execution bridges to local terminals, filesystems, and production databases.

Following 30+ CVE disclosures against MCP tools in early 2026 alone (including CVSS 9.4+ RCEs), verifying the security of MCP servers before plugging them into Claude Desktop, Cursor, or autonomous agent runtimes has become critical.

However, existing scanning approaches suffer from two fatal flaws:

Active RCE on the Scanning Machine: Several popular scanners attempt to execute stdio commands directly from target configuration files to retrieve tool descriptions. If you scan an untrusted third-party server, you are executing arbitrary remote code on your own machine.
False-Positive Floods: Naive YARA or regex scanners trigger up to ~78% false-positive rates by flagging mock keys and test fixtures inside test/ folders.

To see what real-world security looks like, we built a zero-execution AST static auditor and benchmarked 23 prominent reference and community MCP servers.

Here is what we found.

The Audit Benchmark (23 Repositories)

We evaluated 23 MCP implementations across three tiers:

Anthropic Official Reference Servers (modelcontextprotocol/servers)
Archived Reference Servers (modelcontextprotocol/servers-archived)
Popular Community Implementations (fastmcp, slack-mcp-server, brave-search-mcp)

Executive Benchmark Table

#	Target MCP Server	Files Scanned	Trust Score	Grade	Flaws Found
1–7	Anthropic Core Reference (`filesystem`, `fetch`, `git`, `memory`, `sequentialthinking`, `time`)	~60	`100/100`	A+	0
8	Anthropic Reference (`everything`)	41	`85/100`	A	1 (Unauthenticated SSE)
9–20	Archived Reference Servers (`sqlite`, `postgres`, `slack`, `puppeteer`, `github`, `gitlab`, `redis`, `sentry`, `gdrive`)	~60	`100/100`	A+	0
21	FastMCP (Community)	491	`25/100`	F	4 (ZipSlip, 0.0.0.0 SSE, Unconstrained file tools)
22	Slack MCP Server	9	`100/100`	A+	0
23	Brave Search MCP	67	`100/100`	A+	0

What Actually Broke?

1. ZipSlip Archive Extraction (CWE-22)

In community telemetry handling, archive extraction was performed using tarfile.extractall() without safe directory containment or filter flags. In Python environments, unvalidated archive members can write arbitrary files outside the destination directory when unpacked.

The Fix: Always specify filter='data' in Python 3.12+ or sanitize archive member paths before extracting.

2. Unauthenticated Remote SSE Transports on `0.0.0.0` (CWE-306)

Multiple example scripts and server entrypoints bound Server-Sent Events (SSE) transports directly to 0.0.0.0 with no authentication middleware or Bearer token checks.

The Danger: Any client on the local network or public internet can discover the endpoint and execute MCP tool definitions without credentials.
The Fix: Default transport bindings strictly to 127.0.0.1 for local usage, and require Bearer token or OAuth authentication headers whenever binding to 0.0.0.0.

3. Missing Root Path Boundary Containment in File Tools (CWE-22)

We observed tools with functions named read_file or search_files that accept dynamic file path parameters from LLMs and pass them directly to open() without checking if the target path resides within an allowed root.

The Danger: An LLM encountering a prompt injection or untrusted input can easily traverse up directories (../../etc/passwd).
The Fix: Always enforce root boundary checks:

target = (ALLOWED_ROOT / user_path).resolve()
if not target.is_relative_to(ALLOWED_ROOT):
    raise PermissionError("Path traversal attempt detected")

Key Takeaways for Developers Building MCP Servers

Treat tool descriptions as untrusted context: Do not include hidden prompt overrides or unescaped user inputs in tool metadata.
Never invoke dynamic shells: Avoid subprocess.run(shell=True) and child_process.exec(). Always pass arguments as explicit string arrays.
Filter test fixtures from automated scanning: If you run security audits in CI/CD, exclude test mock directories to eliminate 90%+ of false-positive noise.

Run an Audit on Your MCP Servers

If you maintain an MCP server or use them in production, you can test your repository for these exact vulnerabilities without running untrusted code on your machine:

👉 MCP Security & Vulnerability Auditor on Apify Store

Drop in your public GitHub repository URL, and it generates a complete Trust Score (0–100) and actionable remediation report.

DEV Community: Neon Innovation Lab