It’s 4:40 on a Thursday and your ops lead is screen-sharing a diagram nobody asked for. Boxes with arrows. One box is the customer support agent. One is the internal knowledge base. One is a scheduling agent somebody’s intern wired up in March. The arrows between them all say the same three letters: MCP. Someone asks who owns the auth on those connections. The room goes quiet in that specific way rooms go quiet when the honest answer is “nobody, probably.”
That silence is the whole story. The Model Context Protocol went from experiment to plumbing without most teams ever stopping to ask what it does when it fails.
Boring Adoption Is Still Adoption
MCP won. Not dramatically. Anthropic’s open standard for wiring agents to tools and data sources has settled into normal, the way Zuplo’s team describes it: teams picked their setups, adoption turned routine rather than experimental. The 2026 protocol ecosystem maps show structure where 2024 had chaos, when every framework shipped its own tool-calling convention and its own coordination scheme.
Routine is the dangerous part. Experimental tech gets watched. Routine tech gets inherited. You don’t audit the pipes in the walls until something drips through the ceiling.
What the Scans Actually Found
The numbers from this year are not subtle:
- Systemic design flaws disclosed in April 2026, with an estimated 200,000 vulnerable instances in the wild
- A supply chain spanning more than 150 million package downloads
- More than 12,000 MCP servers found exposed to the public internet by independent scans
- Roughly 40% of those running with no authentication at all
- A critical remote code execution vulnerability in Flowise, plus a systemic STDIO command injection flaw disclosed by OX Security
Forty percent with zero auth. Not weak auth, not misconfigured auth. None. That’s roughly 4,800 servers sitting on the open internet, built specifically to let a language model execute tool calls against real systems, with the front door propped open with a brick.
Lab Space called MCP one of the most rapidly weaponized attack surfaces in agentic AI, and the phrase that matters there is “rapidly.” The gap between “this protocol is handy” and “this protocol is a documented liability” was measured in months, not years.
Agent-to-Agent Is Where It Gets Ugly
Single-agent MCP is a security problem you can at least draw on a whiteboard. One model, one server, one set of tools. Bad, but legible.
Multi-agent is different math. MCP is still the more widely adopted protocol for agentic systems, especially where teams want standardized access to tools and data, which means agent-to-agent setups keep reaching for it even when coordination isn’t really what it was built for. Now you’ve got agents calling tools that call agents that call more tools, and every hop inherits whatever the weakest link decided about authentication.
And then the detail that should genuinely bother you: protocols have no memory. MCP and A2A are stateless communication standards. They don’t track what an agent did, what data it touched, or where the output ended up. Stateless is a fine engineering choice. It’s a catastrophic governance choice.
So when something does go sideways across six agent hops, you are not reconstructing an incident. You are doing archaeology with a teaspoon.
The Honest Review
I’m not going to tell you to rip MCP out. That advice is useless and you’d ignore it anyway. It’s solid plumbing for what it was designed to do, and the alternative is going back to every framework inventing its own conventions, which was worse.
What I will say is that the industry did the thing it always does. It standardized the connection layer, shipped it everywhere, and treated identity, authorization, and audit as somebody else’s roadmap item. The 12,000 exposed servers aren’t a protocol bug. They’re a culture bug. Somebody spun up a server to test an idea, it worked, and nothing ever forced the conversation about who’s allowed to call it.
Practical asks, in order of how much they’ll annoy your team:
- Inventory every MCP server you’re running. All of them. Including the ones from March.
- Assume anything reachable from the public internet is already being probed, because the scanners found 12,000 of them and the scanners were not being thorough on your behalf.
- Patch Flowise. Check your STDIO transport paths against the OX Security disclosure.
- Build your own logging layer, because the protocol will not do it for you and your compliance team will eventually ask.
The uncomfortable version of this story is that the riskiest protocol in your stack is the one nobody argued about. No vendor pitch, no procurement review, no security sign-off. Just a dependency that showed up, worked well enough, and quietly became load-bearing.
Go look at the diagram again. Count the arrows. Then go find out who owns them.
🕒 Published: