Nearly 2,000 MCP Servers Possess No Security Whatsoever

Researchers discovered roughly 1,862 publicly reachable Model Context Protocol (MCP) servers with little or no authentication; a 119-server sample all returned lists of available tools and connectors, exposing database and service integrations. The exposure could enable attackers to exfiltrate sensitive data, obtain credentials or API keys, execute arbitrary actions via exposed functions, or run denial-of-wallet attacks, though the researchers stopped short of exploiting the servers and no active in-the-wild abuse is reported.