MCP Servers Get Radware Shield Against Protocol Abuse and DDoS

What Radware launched

On October 14, 2026, Radware announced MCP Server Protection, a product built to secure Model Context Protocol (MCP) servers. These servers are the connectors that give AI agents access to enterprise applications, data and workflows.11 Radware says the product will show organizations what MCP infrastructure they have, defend MCP servers against attacks specific to the protocol, and enforce governance as deployments grow.14 It becomes part of Radware's cloud security platform, alongside the company's Agentic AI Protection and LLM Firewall products. Radware describes the combined offering as covering agents, models and the MCP servers that link them to business systems.18

The release lists five capabilities. The first is visibility: an inventory of deployed MCP servers, the tools and resources they expose, agent activity, usage patterns and communication flows.17 The second is protection designed for MCP. Radware lists protocol abuse, authentication attacks, enumeration of tools and resources, unauthorized MCP interactions, AI-driven tool flooding and denial-of-service attacks as the threats it targets.12 Third, governance features assess exposure, find weaknesses and enforce policy. Fourth, agent monitoring tracks agent identities, tool-invocation patterns, behavioral anomalies and resource consumption.11 Fifth, deployment is flexible. Customers can run the product as a cloud service within Radware Cloud Application Protection Service, or as a cloud-augmented add-on to on-premises Alteon and DefensePro appliances.14 Radware says it supports MCP servers in public clouds, private clouds, Kubernetes and hardware-based data centers.20

Radware CTO David Aviv framed the launch around a simple problem. In his view, MCP is becoming the main integration layer between agents and the enterprise, and each new connection adds to the attack surface. Organizations therefore need to know which MCP servers they run, what those servers expose, which agents use them and whether that use is safe.15 Radware will present the product in a webinar on December 3, 2026.12

Why the server layer is the right target

Radware's central argument is that MCP servers form a new attack surface, and that traditional web and DDoS controls may not be built to understand or protect it.18 Independent research from the past ten months supports that claim, and in places goes further.

The numbers are large and still rising. More than 40 CVEs were disclosed against MCP implementations between January and April 2026 alone, across the Python, TypeScript, Java and Rust SDKs.103 One advisory from April put the number of vulnerable MCP servers worldwide at about 200,000.10 The Cloud Security Alliance tied that figure to a design flaw in the STDIO transport, which was disclosed by OX Security and affects a supply chain of more than 150 million package downloads.6

The exposure figures are equally troubling. Trend Micro found 492 MCP servers reachable from the internet with no client authentication and no traffic encryption, out of more than 8,000 public MCP servers found in February scans.7 Other scans by Wiz, Bloomberry and Censys put the share of servers with no authentication at 38% to 40%.4 An UltraViolet advisory described the share more conservatively as "more than a third."10

The problem extends beyond hobbyist code. Anthropic's own reference Git MCP server received three CVEs in January for path traversal and argument injection.5 In April, Microsoft's Azure DevOps MCP package was found to lack an authentication layer, a flaw rated CVSS 9.1.7 The nginx-ui MCP flaw nicknamed "MCPwn" was a CVSS 9.8 authentication bypass that attackers actively exploited before a patch arrived in March.1 Trend Micro also reported three critical CVSS 9.8 flaws in unofficial Azure and AWS MCP servers. It found that nearly half of the more than 19,000 MCP server codebases it examined recommend storing secrets in plaintext files.2

The security community largely agrees on the cause. Endor Labs argues that most MCP vulnerabilities are familiar bug classes, such as command injection, SSRF, path traversal and missing authentication, appearing on a new and fast-growing surface.5 Pluto Security researcher Yotam Perkal put it this way: when MCP is added to an existing application, the MCP endpoints get the application's full capabilities but not always its security controls.4 Pillar Security makes a related point. An MCP server acts with its own credentials rather than the caller's, so anyone who can reach an unauthenticated server can effectively use its service account.9

The protocol itself leaves the gap open. NSA guidance from May 2026, as quoted in one analysis, says MCP does not define how to tie a session to an identity and has no way to exchange role-based access permissions when a session starts.4 A spec revision in July 2026 removed the session-ID mechanism that attackers had abused. According to coverage of that revision, it still does not require authentication outright.49

Against that background, an inline control that sits in front of MCP servers, catalogs what they expose and screens who calls them is a reasonable product to build. Several of Radware's listed protections, including authentication attacks, enumeration and unauthorized interactions, match the failures researchers keep finding. The Cloud Security Alliance specifically warned that many deployed servers hand over full tool listings to anyone with network access, without checking credentials.6

Where the threat picture and the product diverge

The product lines up with some parts of the research and not others. Radware's pitch leans heavily on traffic-level threats such as DDoS, tool flooding and resource abuse.12 Those are real risks. One developer's audit found that 15% of MCP servers in an Enkrypt AI scan lacked basic limits such as pagination caps.3 Much of the most serious 2026 research, however, points to threats that a server-side gateway may not see.

Tool poisoning is the clearest example. UltraViolet calls it the most consequential attack class specific to MCP.10 It includes "rug pull" attacks, in which a server passes review and then changes its tool definitions in the middle of a session.10 Pillar documented an August campaign, "Deadbugz," in which a malicious MCP server began instructing agents to collect SSH keys and cloud credentials after three ordinary tool calls.9 In that attack the malicious server is the attacker, so protecting the server does not help.

The client side and the supply chain are separate problems as well. Amazon Q auto-loaded MCP configuration files without asking for consent, and Claude Code had a hook-execution flaw.4 The STDIO transport issue lets commands run on local hosts. Anthropic has called this expected behavior, and the issue remains unfixed at the SDK level.46 Pillar also notes that the 2026 specification does not address tool poisoning, malicious packages or prompt injection delivered through tool results.9

This analysis does not argue that Radware's product is mis-aimed. It argues that the product covers one important part of a larger problem. Radware's agent-activity monitoring, which looks at tool-invocation patterns and behavioral anomalies, could catch some of the downstream effects of poisoning or agent hijacking.17 The materials released so far do not show how well it does that. Buyers should treat it as covering inventory, server-side abuse and network threats, and keep separate controls for vetting packages, protecting clients and inspecting tool output.

How the launch was covered

Coverage of the announcement was close to uniform. Trade outlets, financial wires and aggregators mostly republished or summarized Radware's release, repeating the same five capabilities and the same adoption figure.13141720 No outlet reported independent testing, pricing, customer deployments or benchmarks. Quiver's automated summary was the only one to offer a counterpoint. It noted that the release depends on forward-looking statements and that real performance and adoption remain unproven.16

The adoption figure deserves a closer look. Citing Stacklok's State of Model Context Protocol in Software 2026 survey, Radware says nearly half of surveyed software companies use MCP in production, but only 19% report broad production use.11 Read plainly, most organizations are still in early or partial rollouts. That supports Radware's timing: governance tools sell best before MCP sprawl becomes permanent. It also means the market is still forming.

The strategic read

This launch is the latest in a steady series of AI-security releases from Radware. Two weeks earlier the company introduced Agent Trust Management.11 In July it expanded Agentic AI Protection, and in June it announced a partnership with Dataiku.18 The company is clearly trying to move from its roots in DDoS mitigation and application delivery toward AI security. MCP Server Protection fits that plan because it reuses existing assets. The cloud application protection service and the Alteon and DefensePro appliances are the delivery channels, which gives current customers an easy path to adopt it.14

That may be the main point. Pillar's recommended baseline begins with an inventory of every MCP server in use and runtime inspection of tool calls.9 Radware is offering the inventory and runtime layers through infrastructure many enterprises already own. Whether that is enough against a threat landscape increasingly shaped by malicious servers and poisoned context is still an open question. Radware's December webinar and its third-quarter earnings call on October 28 are the next chances to hear specifics beyond the press release.18