Protocols

The MCP Security Problem Is Really a Least-Privilege Problem

The most important security story around agent infrastructure right now is not a single CVE. It is the growing realization that MCP security is immature by default.

As of March 2026, reporting around MCP security points to more than 30 CVEs, thousands of publicly reachable servers with weak or no authentication, and a still-evolving roadmap for making the protocol more production-ready. One especially concerning figure: roughly 36% of observed MCP servers reportedly accept connections without meaningful authentication.