MCP Server Security: Radware Enters a Crowded, Urgent Market

What Radware announced

Radware has launched a product aimed at one of the fastest-growing weak points in enterprise AI: the servers that connect AI agents to corporate systems through the Model Context Protocol (MCP). On October 14, 2026, the company announced Radware MCP Server Protection, which it describes as purpose-built to give organizations visibility into their MCP infrastructure, defend against MCP-specific attacks, and establish governance as deployments grow. 5 The company also says it covers DDoS and abuse aimed at those servers. 5

The service is offered as a cloud-based or cloud-augmented option and sits alongside Radware's existing Agentic AI Protection and LLM Firewall within its cloud security platform. 3 It tracks agent activity, and Radware has scheduled a webinar for December 3. 3 The company's central argument is that MCP servers form a new attack surface that traditional web and DDoS controls were not built to understand. 5

Why MCP has become a target

MCP's appeal is also its risk. It standardizes how agents call tools and reach data, so one weak server can expose whatever sits behind it. Adoption is real but not yet universal. A Stacklok survey found that 19% of software companies report broad production use of MCP. 3 That is large enough to attract attackers and small enough that many security teams are still catching up.

The vulnerability record has grown quickly. By July 2026, 14 CVEs had been assigned to MCP implementations. Researchers also linked a systemic problem to a design choice in Anthropic's official MCP SDKs for Python, TypeScript, Java, and Rust, which reportedly leaves more than 200,000 servers exposed to remote code execution. 2 Affected products include GPT Researcher, LiteLLM, DocsGPT, Bisheng, and a zero-click flaw in Windsurf, all rated critical. 2 The same reporting describes attacks that use prompt injection through tool responses, malicious server registries, config-file hijacking, and sandbox escapes. The most serious example is the DuneSlide pair disclosed by Cato AI Labs, scored CVSS 9.8. 2

Earlier in the year, the warning signs were narrower but pointed the same way. Trend Micro found 492 MCP servers on the internet with no authentication at all. Anthropic's Git MCP server was hit by an exploit chain that turned prompt injection into code execution before it was patched. 1 Those incidents arrived alongside related supply-chain problems in agent ecosystems, including 1,184 malicious skills found on the ClawHub marketplace for the OpenClaw framework. 1

Two numbers, two different problems

The headline exposure figures need careful reading. The 492 servers Trend Micro counted were reachable and unauthenticated, which is a deployment-hygiene failure. 1 The 200,000 figure describes servers exposed through an inherited SDK design choice, which is a structural, upstream problem. 2 These are different measurements, not a jump from hundreds to hundreds of thousands. The distinction matters for defenders. Misconfigured servers can be fixed with better operational discipline. SDK-level issues ripple into every product built on the affected code, and they argue for runtime controls that inspect protocol traffic rather than relying only on patching.

A market filling up fast

Radware is far from alone. Dedicated startups have raised money quickly. Runlayer emerged from stealth with an $11 million seed round in November 2025 and closed a $30 million Series A in June 2026. 4 Gateway vendors such as MintMCP target the informal reality of MCP adoption. MintMCP converts STDIO-based servers running on individual laptops into OAuth-protected, centrally monitored services. 4 Large platforms are folding MCP into existing suites too. Palo Alto Networks' Prisma AIRS offers a managed MCP server that acts as a gateway, scanning tool definitions, inputs, and outputs for context poisoning and exposed credentials. 4

This leaves three approaches competing:

• Specialist MCP platforms, which focus only on the protocol.
• Governance gateways, which bring unmanaged servers under control.
• Incumbents bundling MCP coverage into broader AI-runtime security.

Radware fits the third group. Its pitch adds traffic-layer strengths, such as DDoS mitigation and abuse protection, that pure-play startups may not emphasize. 5

The takeaway

In my reading, Radware's launch says less about the company than about where MCP is in its life cycle. A protocol that collected more than a dozen critical CVEs in about a year, while still only in broad production at roughly a fifth of software firms, is following the path of earlier integration layers like APIs. Insecure defaults come first, then exploitation, then a wave of vendors.

For buyers, product count matters less than coverage. Which tools address SDK-level flaws, which only enforce authentication, and which can see tool-response injection as it happens? The vendors that answer those questions concretely will matter more than the growing list of logos.