MCP FAQ: Servers, Clients and Security

What MCP Actually Is — Hosts, Clients and Servers

Picture a universal power socket for AI: any agent can plug into any data source or tool, and everything just works. That's the promise of the Model Context Protocol (MCP), introduced by Anthropic in late 2024 and now shipped by default in Claude Desktop, Cursor, and every major IDE, with thousands of public servers on GitHub.

To understand both the power and the risk, it helps to break MCP down into its three components. The Host is the AI application itself — your chatbot or coding agent — running on your machine. The Client is the connective tissue inside that host, which talks to servers and invokes tools on the agent's behalf. The Server is the backend service doing the actual work: querying a database, sending an email, reading a file.

Each server exposes three kinds of things, called primitives:

• Tools — actions the agent can take, like searching the web or writing a file.
• Resources — data the agent can read, such as documents or records.
• Prompts — reusable instruction templates the server offers to guide the agent.

Under the hood, clients and servers communicate using JSON-RPC 2.0 messages, over either a local stdio transport or Streamable HTTP for remote connections. That plumbing is well specified. What's less uniform is security: the spec makes authorization optional, leaving each server owner to decide whether — and how — to implement it. Many simply don't.

Here's the part every reader should internalize, technical or not: every connected server is a new trust boundary. Tool descriptions, retrieved documents, and tool outputs all flow into the agent's context as trusted text, and the model has no native way to distinguish legitimate output from injected instructions. Researchers cataloging the first OWASP framework dedicated to MCP counted more than 30 CVEs filed against MCP servers, clients, and infrastructure in just the first two months of 2026. When Palo Alto Networks' Unit 42 connected five MCP servers to a single agent, they measured a 78.3% attack success rate.

The lesson isn't to avoid MCP — it's to treat every server you connect the way you'd treat any piece of software from a stranger. If you wouldn't install a random binary from an internet forum, don't plug a random tool into your agent. That's exactly the problem SkillzBench is being built to solve: a free directory that verifies and security-scans agent skills, and a free MCP connector where your agent only sees the skills and tools you explicitly choose — so trust boundaries stay where you put them.

Why MCP Security Is a Real Problem, Not a Theoretical One

MCP security is no longer a topic for threat-modeling whiteboards. In just two months — January and February 2026 — more than 30 CVEs were filed against MCP servers, clients, and infrastructure, and 43% of them were shell injection vulnerabilities, the kind that let attackers run commands on your machine.

The numbers get worse the closer you look. Palo Alto Networks' Unit 42 measured a 78.3% attack success rate when five MCP servers were connected to a single AI agent — a realistic setup for any developer wiring a few tools into Claude Desktop or Cursor. And a survey of 2,614 MCP servers found that 82% were exposed to path traversal, 67% exposed APIs related to code injection, and 34% were vulnerable to command injection.

The problem isn't exotic AI-native attack techniques, either. As the Cycode team put it, these are "classic web application vulnerabilities wearing new uniforms, and they are exploitable today." MCP just gives old flaws a new, under-defended surface to land on.

Real incidents back this up:

• The Postmark MCP backdoor — the first malicious MCP server caught in the wild — silently exfiltrated users' emails.
• A "toxic agent flow" attack on GitHub combined broad-scoped personal access tokens with prompt injection via a public issue, causing an agent to leak private repositories into public pull requests.
• CVE-2025-6514 in the mcp-remote package, a CVSS 9.6 command injection flaw, had been downloaded over 437,000 times before disclosure.
• CVE-2025-49596 in Anthropic's own MCP inspector quietly opened a backdoor on thousands of developer machines.

Meanwhile, Bitsight researchers found hundreds of internet-exposed MCP servers with no authorization at all — servers that "cheerfully answer any question you throw at them," revealing exactly which tools and data they're wired into. Because the MCP spec makes authorization optional, protection depends entirely on each server owner. And many simply don't bother.

The lesson for anyone equipping agents: treat every tool, server, and skill you connect as untrusted code until proven otherwise. That's the same principle behind SkillzBench's approach — security-scanning and pinning every skill version to a commit SHA before it ever reaches an agent. If you wouldn't install a random binary from Reddit, don't plug a random tool from GitHub into your agent either.

The Five Attack Patterns Everyone Connecting MCP Should Know

MCP's convenience is exactly what makes it dangerous: every connected server becomes a new trust boundary, and a single compromised one can hijack an entire agent workflow. The attacks showing up in the wild aren't exotic AI-native exploits — they're classic web vulnerabilities in new uniforms, and they cascade.

Start with the confused deputy problem in OAuth flows. When static client IDs, dynamic client registration, and consent cookies align, attackers can obtain authorization codes without genuine user consent, as documented in the official MCP security guidance. Related to it is token passthrough, which the spec explicitly forbids: a server that accepts tokens not issued for it breaks the audit trail and bypasses downstream rate limits.

Then there's prompt injection via tool outputs. Returned content enters the model's context as trusted input, and the model has no native mechanism to separate legitimate output from injected instructions. The GitHub MCP "toxic agent flow" attack showed the consequences: broad-scope personal access tokens plus indirect injection through a public issue body caused an agent to exfiltrate private repositories into public pull requests.

The remaining patterns compound the damage:

• Overprivileged credentials — organization-wide tokens sitting in config files and environment variables, rarely rotated or scoped.
• Tool poisoning — malicious instructions hidden in tool descriptions that scanners never read.
• Supply chain drift — the Postmark MCP backdoor silently exfiltrated email, and CVE-2025-6514 in mcp-remote carried a CVSS of 9.6 after 437,000+ downloads.
• Shadow servers that never appear in any inventory, leaving 81% of organizations without full visibility into AI use.

The scale is measurable. Palo Alto Networks Unit 42 recorded a 78.3% attack success rate when five MCP servers connected to a single agent, and 30+ CVEs hit MCP servers, clients, and infrastructure in just two months. The guidance exists; adoption lags. That gap is precisely where SkillzBench's Verify work — pinning every skill version to a commit SHA and security-scanning before anything reaches an agent — is being built to help.

A Practical Security Checklist for Users and Builders

The MCP specification offers solid security guidance, but adoption remains the bottleneck. A practitioner survey captured the gap precisely: best practices exist, yet almost nobody was using them.

Authorization: implement OAuth 2.1, even though the spec calls it optional. The MCP specification makes authorization optional, leaving enforcement to each server owner, and many simply skip it. When servers do implement it, OAuth 2.1 is the mandated standard, with mechanisms including Protected Resource Metadata (RFC 9728), Dynamic Client Registration (RFC 7591), and Resource Indicators (RFC 8707) to bind tokens to specific servers. Validate the aud claim, use exact-match redirect URI validation, and reject token passthrough entirely.

Treat every tool output as untrusted input. Tool descriptions, retrieved documents, and server responses all enter the agent's context window as trusted text, even when originating from attacker-controlled sources. The SlowMist checklist warns explicitly: do not directly insert returned data into context. Sanitize, wrap, and audit incoming content; use context isolation and instruction quarantine.

Enforce least privilege and sandbox aggressively. Unit 42 measured a 78.3% attack success rate when five MCP servers were connected to a single AI agent. Containerize servers, run non-root, restrict APIs, block egress, and use scoped service identities instead of personal access tokens. High-risk operations like file deletion or fund transfers must require explicit user confirmation.

Maintain an inventory, because visibility is the prerequisite for defense. According to the Cycode 2026 State of Product Security report, 81% of organizations lack full visibility into AI use across the SDLC, and 65% report increased security risk from AI tooling. An AIBOM (AI Bill of Materials) tracking every MCP server in use, its version, its permissions, and its provenance is becoming essential as NIST, EU AI Act, and SOC 2 frameworks increasingly touch agent behavior.

Log everything and monitor continuously. Capture all tool calls, inputs, outputs, timestamps, and user approvals. Watch for outbound traffic to unexpected destinations and supply-chain drift when servers update upstream. The same discipline that catches a poisoned tool description on day 30 catches a rug pull on day 300.

The hard truth: MCP's convenience is exactly what makes it dangerous. These controls are not exotic; they are standard hygiene applied to a new surface. SkillzBench is building toward this same discipline for agent skills, pinning every version to a commit SHA, scanning for vulnerabilities, and tracking upstream changes so builders know what they're connecting before they connect it. Browse the free skills directory at skillzbench.com to see verified, benchmarked skills ready to equip your agent.

How to Connect Agent Skills Without Inheriting the Risk

Every skill or tool you hand an agent arrives with its powers and its problems attached. The numbers back that up: researchers measured a 78.3% attack success rate when just five MCP servers were connected to a single AI agent, and more than 30 CVEs were filed against MCP servers, clients, and infrastructure in the first two months of 2026. The Postmark MCP backdoor — the first malicious server caught in the wild — silently exfiltrated emails. Skills carry the same supply-chain risk: published research found roughly 26% of agent skills carry at least one vulnerability.

The lesson is simple: vet before you connect. As the practitioner guidance puts it, if you wouldn't install a random binary from Reddit, don't plug in a random tool from GitHub. Yet most people add skills straight from a repo with no review at all, and traditional scanners can't even see the risk — malicious instructions hide in tool descriptions and metadata fields that SAST and SCA tooling never read.

So what does proper vetting actually look like? It means checking a skill before an agent ever sees it:

• Pin every version to a specific commit SHA, so a "rug pull" can't swap safe code for malicious code after you've approved it.
• Security-scan the package for command injection, path traversal, and overprivileged credential handling — the flaws behind 82% path traversal exposure across 2,614 surveyed MCP servers.
• License-check it, so you know what you're legally allowed to run in your business.
• Benchmark it in a sandbox with the same model, with and without the skill, so you know whether it actually helps — not just that it runs.
• Track upstream changes, re-scan, and re-benchmark when the author pushes an update.

Vetting solves half the problem. The other half is least privilege at the agent level. Unit 42's 78.3% finding shows what happens when an agent sees too many servers at once — attackers chain individually "authorized" calls across trust boundaries. The fix is a loadout model: you explicitly toggle which skills and tools each agent gets, and the agent sees nothing else. That's the Equip model SkillzBench is building — one free MCP connector plus per-agent loadouts, so exposure is a choice you make, not a default you inherit.

SkillzBench is a free, independent directory of agent skills that continuously crawls GitHub, dedupes what it finds, and applies its Verify pillar — commit-SHA pinning, security scanning, license checks, and quality judging — before publishing a trust score from 0 to 100. Lift is always shown separately from ratings, and money never touches scores. Everything — the directory, the MCP connector, benchmarks, and alerts — will be free at launch.

The product isn't public yet; the waitlist is live. If you're extending agents with skills, extend them cautiously — skills, proven beats skills, hoped. Join the SkillzBench waitlist and be first in line when vetted skills and the free MCP connector arrive.