MCP Servers on the Internet

Censys scanned the public Internet and found 12,520 Model Context Protocol (MCP) services on 8,758 IPs (56 countries) that commonly lack enforced authentication; many advertise highly sensitive capabilities such as direct database query interfaces, system control (shell/PowerShell execution), and automation tools, creating significant risks for data disclosure, unauthorized access, and abuse of trusted integrations despite no active exploitation being confirmed during the scan.