MCP security: are current controls keeping up with agent tools?

TL;DR: 24,008 unique secrets exposed in public GitHub configs, 2,117 still valid, and attack paths spanning tool poisoning, injection, and malicious servers, according to PipeLab’s snapshot of MCP security in 2026. The core problem is that MCP trust assumptions break once agents treat tool definitions and responses as trusted runtime input.

Editorial analysis by NHI Mgmt Group, based on content published by PipeLab: “The State of MCP Security 2026: Incidents, Attack Patterns, and Defense Coverage”.

By the numbers:

• 82% of 2,614 analyzed MCP implementations use file operations prone to path traversal.
• 67% use APIs related to code injection.
• The first publicly documented malicious MCP server, postmark-mcp, reached about 300 real organizations before disclosure.

Key questions

Q: What breaks when MCP tools are treated as trusted by default?

A: When MCP tools are trusted by default, a poisoned or spoofed component can inherit privileged access, manipulate outputs, or expose secrets without crossing a traditional perimeter.

Q: Why do MCP deployments increase risk if organisations do not govern tool permissions and secrets carefully?

A: MCP can accelerate AI agent access to tools and data, but that also concentrates trust in a small set of configuration and credential paths.

Q: What are the signs that an MCP server has become a supply chain risk?

A: Look for packages that ship clean versions first, then change behaviour later, or for servers with broad workflow reach but weak review, provenance, and revocation.

Practitioner guidance

• Audit MCP server inventory and ownership Identify every approved MCP server, who owns it, what data it can reach, and whether the approval path is still current.
• Scan tool definitions and responses at runtime Inspect descriptions, arguments, and returned content on every session so hidden instructions and injected data are visible before the agent acts.
• Validate file paths and command arguments strictly Reject escaping paths, canonicalise inputs before authorisation, and block any tool argument that can change the filesystem target or shell behaviour.

Bottom line: MCP creates a trust boundary problem where poisoned tool content, malicious servers, and exposed secrets can all steer agent behaviour.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →