Exposed MCP servers across the internet
knostic.ai
Exposed MCP servers across the internet
1–10 of 31 posts
Re: Exposed MCP servers across the internet
#2Sure, but I was expecting more details on what was available. At least some analysis (perhaps using embeddings) on common function names, types, etc. What are people exposing? Is there overlap? What % of the open servers looked the same (indicating a common example / tutorial deployment)? What's the proportion of read/write functions (again using embeddings / word cloud maybe?)...
As is the article feels a bit light on details. I'm not surprised that there are open servers out there, but if you're writing an article about that, at least provide interesting details.
Re: Exposed MCP servers across the internet
#3Hmmm. I thought that's the idea of MCP server - give LLM an interface to use your service. Why would it require authentication?
One of the tools could be to authenticate.
Please destroy this position if I'm wrong.
Re: Exposed MCP servers across the internet
#4What happened to best practices? Starting a demo locally is something but opening it up to the internet irresponsibly is something else.
Re: Exposed MCP servers across the internet
#5> We identified a total of 1,862 MCP servers exposed to the internet. From this set, we manually verified a sample of 119. All 119 servers granted access to internal tool listings without authentication.
Here we go again.
Before we had seen (and there still) MongoDB databases exposed all over the internet with zero credentials protecting them. (you can just connect to them and you are in.)
Now we have exposed MCP servers waiting to be prompt injected and their data to be exfiltrated from say, a connected service or database if they are connected to any. [0]
So now you can just talk to anyone's exposed MCP server and ask for the secret passwords, environment variables and sensitive data.
And the AI will just hand it all over.
Re: Exposed MCP servers across the internet
#6> We identified a total of 1,862 MCP servers exposed to the internet. From this set, we manually verified a sample of 119. All 119 servers granted access to internal tool listings without authentication. Here we go again. Before we had seen (and there still) MongoDB databases exposed all over the internet with zero credentials protecting them. (you can just connect to them and you are in.) Now we have exposed MCP ser…
How did they breach the server? They uh.. They told it that someone would die if it didn't send the .env with the AWS keys to prevent-the-tragedy.xyz
Re: Exposed MCP servers across the internet
#7> We identified a total of 1,862 MCP servers exposed to the internet. From this set, we manually verified a sample of 119. All 119 servers granted access to internal tool listings without authentication. Here we go again. Before we had seen (and there still) MongoDB databases exposed all over the internet with zero credentials protecting them. (you can just connect to them and you are in.) Now we have exposed MCP ser…
hide all the printers! demand biometrics!
safety people are excessive, too
Re: Exposed MCP servers across the internet
#8What happened to best practices? Starting a demo locally is something but opening it up to the internet irresponsibly is something else.
At least you can chat with the server when you feel lonely as a hacker. With MongoDB, you only get bson data.
Re: Exposed MCP servers across the internet
#9Hmmm. I thought that's the idea of MCP server - give LLM an interface to use your service. Why would it require authentication? One of the tools could be to authenticate. Please destroy this position if I'm wrong.
The two things I can think of are MCP servers with functions that make calls to a database with sensitive information, or are easy to pwn due to propping them up in a hasty and irresponsible manner.
The article would actually be interesting if they tried either of those with the servers they found.
Re: Exposed MCP servers across the internet
#10Hmmm. I thought that's the idea of MCP server - give LLM an interface to use your service. Why would it require authentication? One of the tools could be to authenticate. Please destroy this position if I'm wrong.
That only makes sense if models were autonomously adding MCP servers and managing accounts themselves. Currently, users add MCP servers to their clients (like Cursor or Claude Desktop), so authentication should happen at that level. If the model handled auth, you'd still need to provide credentials to the LLM for it to provide it to the MCP server anyway. It's better to pass auth data as for example headers in requests - this way your credentials never get sent to the model provider (unless you're running locally).