Model Context Protocol ecosystem faces security and structural risks

The Model Context Protocol (MCP) ecosystem is facing significant security and structural challenges. Security scans have identified thousands of publicly accessible MCP servers, including those in private home environments exposed via tunneling services. These setups are vulnerable to command injection due to architectural decisions in how SDKs handle transport logic via STDIO.

Supply chain risks are also escalating. A recent campaign known as Deadbugz successfully compromised 23 AI projects within 74 minutes by targeting the MCP server supply chain rather than the projects' own code. Researchers have documented malicious servers, such as postmark-mcp, and identified vulnerabilities like cluster-token leaks and server-side request forgery.

To combat these threats, developers are testing various security scanners, including WARDEN, mcp-audit, and mcp-shield, to detect tool-poisoning and malicious tool definitions.

Beyond security, data analysis of over 12,000 MCP server and agent-skill repositories reveals a highly centralized ecosystem. The market lacks a middle class, with the top 10% of repositories holding approximately 83% of all stars. While agent skills show higher activity and engagement, a large portion of the server population remains dormant or has very low engagement.