MCP Server Security: Why Agent Supply Chains Are Now the Target

The protocol connecting AI to everything has a trust problem

The Model Context Protocol (MCP) has quickly become a common way to link AI assistants to tools, data stores, and outside services. That reach is also the source of its security trouble. Each MCP deployment involves several parties: the user, the AI host application, the MCP client, the MCP server, the tools that server exposes, and the systems behind those tools. Each party may hold different assumptions about who is acting, what they have agreed to, and what they are permitted to do. 1

When those boundaries blur, small inputs can cause large effects. A prompt that looks harmless, or a document the model retrieves, can push the model into calling a tool, reading data, or taking an action the user never actually approved. 1 OWASP has identified the overlap of prompt injection, supply-chain risk, and "confused deputy" failures as a central concern for MCP. A confused deputy is a privileged component that gets tricked into misusing its own authority. 1

The numbers behind the warning

The conceptual risks are now backed by survey data. Trend Micro found 492 MCP servers exposed to the internet with no authentication at all. 2 BlueRock examined about 7,000 MCP servers and judged 36.7% of them vulnerable to server-side request forgery (SSRF). 2 SSRF lets an attacker make a server send requests on their behalf, often into internal networks that would otherwise be out of reach.

The marketplace layer shows similar problems. Antiy CERT confirmed roughly 1,184 malicious skills on the OpenClaw ClawHub marketplace. At its peak, that was about one in five packages. 2 Those figures describe an ecosystem where installing a third-party integration is a real gamble, not a rare edge case.

The pattern also extends past MCP. According to Google's threat intelligence, agent orchestration frameworks account for half of recent CVEs in the AI stack. These include Langflow, Flowise, LangChain, and MCP. 2 Google also reported active in-the-wild exploitation of flaws in LiteLLM and Langflow. 2

Two framings, one conclusion

The two perspectives start from different places. Checkmarx's framing is architectural. It focuses on how trust and consent are spread across many components, and how a model can be steered into acting against the user's intent. 1 That is mostly a story about agent behavior: what the model can be persuaded to do.

Adversa.ai's framing deliberately moves away from behavior. It argues that the infrastructure itself is the weak point: the servers, marketplaces, and frameworks. In that view, the supply chain, not just the agent's decisions, is now the attack surface. 2 Its recommendation is blunt. CISOs should patch agent infrastructure on the same schedule they use for internet-facing servers. 2

These views are not really in conflict. They describe two layers of the same problem. Prompt injection and confused-deputy failures explain how an attacker turns a model against its user. Unauthenticated servers, SSRF-prone code, and poisoned skill marketplaces explain why attackers often won't need to bother. They can go after the plumbing directly. OWASP's grouping of prompt injection with supply-chain risk already points to this convergence. 1

What it means in practice

My reading is that the infrastructure argument deserves the most urgency right now. Prompt injection remains a hard research problem with no clean fix. Exposed servers with zero authentication, however, are basic operational failures with well-known remedies. When about a third of sampled servers carry SSRF risk, and a public marketplace hosts malicious packages at a rate near 20%, the main issue is no longer clever model manipulation. It is a young ecosystem shipping fast without basic hygiene.

For security teams, the practical takeaways follow from the evidence:

• Inventory MCP servers like any other network service. Require authentication on them and keep them off the public internet unless there is a clear reason not to.
• Vet third-party skills and packages with the same scrutiny applied to open-source dependencies, since marketplace poisoning is documented. 2
• Narrow tool permissions and require explicit user consent for sensitive actions, which limits how much damage a confused-deputy failure can do. 1
• Track CVEs in orchestration frameworks closely. Google has observed active exploitation of LiteLLM and Langflow. 2

MCP's value comes from connecting models to real systems. Without these controls, it also connects attackers to those same systems. The evidence suggests that, for now, organizations deploying agents should treat that connective layer as untrusted by default.