Show HN: We scanned 23 public MCP servers for CVEs - Here is what broke

In 2026, tens of thousands of Model Context Protocol (MCP) servers were published, enabling AI agents to directly execute commands on local terminals, filesystems, and production databases. Due to the high number of CVE disclosures affecting MCP tools in early 2026, verifying the security of these servers before integration with applications like Claude Desktop, Cursor, or autonomous agents became critical.

However, existing scanning methods have two major issues: they can cause active Remote Code Execution (RCE) on the scanning machine, and false-positive rates can be as high as 78% due to naive scanning approaches.

To address these problems, researchers developed a zero-execution AST static auditor and evaluated 23 prominent MCP servers. The audit found several critical vulnerabilities. Firstly, archive extraction in community telemetry handling was performed insecurely using tarfile.extractall() without safe directory containment or filter flags. This allowed arbitrary file writing outside the destination directory in Python environments, which could be exploited by attackers.

Secondly, multiple example scripts and server entrypoints bound Server-Sent Events (SSE) transports directly to 0.0.0.0 without authentication. This allowed any client on the local network or public internet to execute MCP tool definitions without credentials, posing a significant security risk.

Lastly, tools with functions like read_file or search_files accepted dynamic file path parameters from LLMs and passed them directly to open() without checking if the target path resided within an allowed root. This exposed the servers to path traversal attacks, where an attacker could navigate to sensitive files such as /etc/passwd.

The researchers recommend treating tool descriptions as untrusted context, avoiding dynamic shells, passing arguments as explicit string arrays, filtering test fixtures from automated scanning, and enforcing root boundary checks to prevent path traversal attacks. They also provide an MCPSecurity & Vulnerability Auditor on Apify Store to test repositories for these vulnerabilities without running untrusted code.