Exposed MCP Servers: When AI Tool Endpoints Are Open to the Internet

What is an MCP server?

The Model Context Protocol (MCP) is an open standard that lets AI models and agents call external tools and read external data. An MCP server advertises a list of tools, such as "query this database", "read this file" or "run this command", and an AI client calls them on a user's behalf.

MCP servers are easy to build and are often started quickly by developers experimenting with AI agents. Some run locally for one user. Others are deployed as remote services that many users or agents connect to over HTTP. The second kind is where exposure becomes a problem.

Why exposed MCP servers are risky

An MCP server is, by design, a menu of actions. If the server is reachable from the internet and does not require authentication, anyone who finds it can see that menu, and may be able to use it.

Censys scanned for internet-accessible MCP services and reported its findings in a 2026 study:

• 12,520 MCP services across 8,758 IP addresses as of 28 April 2026, in 56 countries.
• The protocol does not require authentication or authorisation by default, and the servers discussed in the study were accessible without it.
• 88.3% advertised at least one tool, with an average of 6.5 capabilities per service.
• More than 1,000 advertised database query interfaces, and several hundred advertised infrastructure or system control functions.
• Roughly 90 advertised tools for running commands.

Censys states that it never executed any functionality on these servers, and that advertising a tool does not prove it works. Some of the servers may be test deployments. But the numbers show how easily powerful capabilities end up on the public internet.

What an attacker can do with one

Depending on which tools a server exposes, an attacker may be able to:

• Read data the server was meant to give only to trusted AI agents
• Query or modify databases connected to it
• Trigger actions in connected business systems
• Run commands on the host, if command-execution tools are present
• Use the server as a stepping stone into the internal network

Automated tools make the first step trivial. Attackers, including those using AI-assisted tooling, scan for known protocol signatures and probe whatever answers.

How to check for exposed MCP servers

1. Inventory your AI tooling. Ask engineering and data teams what MCP servers they have deployed, and where.
2. Look for HTTP-based MCP endpoints. Review reverse proxy configs, cloud load balancers and container port mappings for MCP services.
3. Test from outside your network. If an endpoint responds to an unauthenticated request from the internet, treat it as exposed.
4. Watch your external attack surface. New hosts, new subdomains and unexpected open ports are how forgotten MCP servers usually appear.

How to secure MCP servers

1. Prefer local transport. If a server only needs to serve one user on one machine, run it locally and do not bind it to a public interface.
2. Require authentication on remote servers. The MCP specification supports OAuth-based authorisation. Use it, or place the server behind an authenticating reverse proxy or identity-aware proxy.
3. Restrict the network. Allow connections only from known clients, a VPN or a private network.
4. Apply least privilege to tools. Give each server the narrowest possible database role, file path and API scope. Avoid tools that run arbitrary commands unless you truly need them.
5. Review third-party servers before use. Treat community MCP servers like any other dependency: check the source, pin versions and limit their access.
6. Log tool calls. Record which tool was called, by whom and with what arguments, and alert on unusual use.

How SurfaceScan helps

SurfaceScan continuously maps your internet-facing hosts, subdomains and open ports from the outside. A new service appearing on your perimeter, whether it is an MCP server, a model endpoint or an automation tool, shows up as a change in your attack surface so you can decide whether it should be there. Pair this with the guides on open ports and exposed database ports to close the most common doors first.