MCP Servers in Federal Agencies Remain Unpatched as Tools Emerge
Five federal MCP servers, including a VA tool logging SSNs, stay unpatched six weeks after disclosure as an open-source scanner and IETF draft emerge.
The Model Context Protocol (MCP) is an open standard, introduced by Anthropic, that defines how AI assistants and agents connect to external tools, data sources, and services. An MCP server exposes a set of capabilities, such as querying a database, calling an API, or taking actions inside a business platform, so that any compatible AI client can discover and use them. The protocol replaces one-off integrations with a common interface, which has made it a foundational layer for agentic AI.
Adoption has moved quickly. Major platforms and niche data providers alike are publishing MCP servers so that models can work directly with their products. Some are expanding from read-only access to tools that create, configure, and spend. That shift raises the stakes. Every server an agent trusts becomes part of its attack surface, and researchers keep finding weaknesses across the ecosystem:
This hub tracks the MCP landscape from both sides. On the security front, expect vulnerability disclosures, attack research, supply-chain incidents, and analysis of which defenses work and which fall short. On the adoption front, we cover new server launches, enterprise and public-sector deployments, and how companies are wiring their services into AI assistants. Whether you build, secure, or evaluate AI agents, this is where to follow how the protocol is evolving and where its risks lie.
Five federal MCP servers, including a VA tool logging SSNs, stay unpatched six weeks after disclosure as an open-source scanner and IETF draft emerge.
Research shows MCP tool poisoning hijacks AI agents at high rates, and CVEs prove one-time description checks can't stop rug-pull and schema attacks.
A design flaw in Anthropic's MCP STDIO transport enables RCE across 7,000+ servers. Anthropic won't patch it, and most MCP marketplaces don't vet submissions.
Five federal MCP servers, including VA and CMS Blue Button, remain unpatched against two separate flaws, with one SSRF report stuck in GSA triage for six weeks.
The Shai-Hulud npm worm hit 440+ packages and abused the official MCP registry, listing clean packages that linked to poisoned repositories.
Researchers found Claude Code plugins, MCP servers and hooks run unsandboxed under one consent click, enabling RCE and credential theft from untrusted repos.
Rust rmcp and Ruby mcp SDKs shipped Streamable HTTP transports without Host/Origin checks, letting malicious sites hijack local MCP servers via DNS rebinding.
Meta launches an official MCP server letting AI agents configure and test WhatsApp Business setup, distinct from prior unofficial community tools.
X launched a hosted MCP server in June that connects Claude, Cursor and Grok to its API, then added an Ads MCP in August that lets AI agents manage ad
Impala launched an MCP server on Aug. 19, 2026, letting Claude and ChatGPT query its database of funders, nonprofits and grants to build custom AI tools.
GhostSplice attack splits MCP server instructions to trick AI coding agents into leaking SSH keys, secrets, and source code.
Researchers detail GhostSplice, a technique letting malicious MCP servers split commands to make AI coding agents leak secrets and code.
Snap launches an MCP server for advertisers, joining Rechat, Oviond, TitanMind and Grasshopper in adopting the AI connector standard.
Reuters launched an MCP server letting AI agents pull verified Reuters news directly into enterprise workflows.
Zendesk adopts the MCP standard to unify AI agents and improve interoperability across customer service tech stacks.