200,000 exposed MCP servers is what happens when a protocol ships before its threat model

Reporting on the Model Context Protocol's third quarter counts fourteen CVEs and roughly 200,000 vulnerable instances exposed across IDEs, internal tools and cloud services. Those numbers invite a story about sloppy engineering. The underlying analysis tells a more specific one.

The flaws are ordinary. The distribution is not.

Endor Labs examined 2,614 MCP implementations and found 82% using file operations prone to path traversal, 67% using APIs associated with code injection, and 34% using APIs susceptible to command injection. None of those are novel attack classes. They are the same categories application security has been cataloguing since the early 2000s.

What is new is that they arrived pre-distributed. A protocol's design decisions replicate into every implementation that follows the specification, so a weakness is not one vulnerability but as many as there are servers. The CVE list reflects that: LiteLLM, Windsurf, DocsGPT, Bisheng, Flowise, Cursor, MCP Inspector, and a package published as create-mcp-server-stdio all appear, most rated critical.

The ecosystem shipped faster than it hardened, and the protocol carried the same mistake into every implementation at once.

The 200,000 figure is a floor

Public scanners can only see public repositories. Internal enterprise MCP servers — the ones wired to production databases and CI pipelines — are invisible to them, and by construction those carry the broader tool surface and the more consequential credentials.

So the exposure count is measuring the part of the estate that is easiest to see and least likely to matter. Whatever number you read, assume the interesting servers are not in it.

Find yours before you patch anything

MCP servers are absent from most asset inventories because nobody registered them. They live on developer machines, in CI runners and in side projects, and they are trivial to stand up — that is the point of the protocol. Software that is easy to deploy accumulates instances faster than it accumulates operators, and that gap is what the exposure figure is really measuring.

Scan for the process names and default ports rather than asking teams to self-report, because the teams that would answer are not the ones with the problem. Registries such as AgentSeal now publish risk scores for 800-plus public servers, which is a reasonable starting point for anything you pulled from a public source.

Then check what each one holds. An MCP server's blast radius is its tool list and its resident credentials, not its version number — which is why patching alone closes less of this than the CVE count suggests.

Written by the Devence Lab research team.