{"slug": "show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke", "title": "Show HN: We scanned 23 public MCP servers for CVEs - Here is what broke", "summary": "A developer built a zero-execution AST static auditor and benchmarked 23 public MCP servers, finding critical vulnerabilities in the FastMCP community server, including ZipSlip, unauthenticated SSE, and unconstrained file tools. The audit graded Anthropic reference servers A+ with no flaws, while FastMCP scored 25/100 with four flaws.", "body_md": "With tens of thousands of Model Context Protocol (MCP) servers published in 2026, AI agents now have direct execution bridges to local terminals, filesystems, and production databases.\n\nFollowing 30+ CVE disclosures against MCP tools in early 2026 alone (including CVSS 9.4+ RCEs), verifying the security of MCP servers before plugging them into Claude Desktop, Cursor, or autonomous agent runtimes has become critical.\n\nHowever, existing scanning approaches suffer from two fatal flaws:\n\n`stdio`\n\ncommands directly from target configuration files to retrieve tool descriptions. If you scan an untrusted third-party server, you are executing arbitrary remote code on your own machine.`test/`\n\nfolders.To see what real-world security looks like, we built a zero-execution AST static auditor and benchmarked **23 prominent reference and community MCP servers**.\n\nHere is what we found.\n\nWe evaluated 23 MCP implementations across three tiers:\n\n`modelcontextprotocol/servers`\n\n)`modelcontextprotocol/servers-archived`\n\n)`fastmcp`\n\n, `slack-mcp-server`\n\n, `brave-search-mcp`\n\n)| # | Target MCP Server | Files Scanned | Trust Score | Grade | Flaws Found |\n|---|---|---|---|---|---|\n| 1–7 |\nAnthropic Core Reference (`filesystem` , `fetch` , `git` , `memory` , `sequentialthinking` , `time` ) |\n~60 | `100/100` |\nA+ |\n0 |\n| 8 |\nAnthropic Reference (`everything` ) |\n41 | `85/100` |\nA |\n1 (Unauthenticated SSE) |\n| 9–20 |\nArchived Reference Servers (`sqlite` , `postgres` , `slack` , `puppeteer` , `github` , `gitlab` , `redis` , `sentry` , `gdrive` ) |\n~60 | `100/100` |\nA+ |\n0 |\n| 21 | FastMCP (Community) |\n491 | `25/100` |\nF |\n4 (ZipSlip, 0.0.0.0 SSE, Unconstrained file tools) |\n| 22 | Slack MCP Server |\n9 | `100/100` |\nA+ |\n0 |\n| 23 | Brave Search MCP |\n67 | `100/100` |\nA+ |\n0 |\n\nIn community telemetry handling, archive extraction was performed using `tarfile.extractall()`\n\nwithout safe directory containment or filter flags. In Python environments, unvalidated archive members can write arbitrary files outside the destination directory when unpacked.\n\n`filter='data'`\n\nin Python 3.12+ or sanitize archive member paths before extracting.`0.0.0.0`\n\n(CWE-306)\nMultiple example scripts and server entrypoints bound Server-Sent Events (SSE) transports directly to `0.0.0.0`\n\nwith no authentication middleware or Bearer token checks.\n\n`127.0.0.1`\n\nfor local usage, and require Bearer token or OAuth authentication headers whenever binding to `0.0.0.0`\n\n.We observed tools with functions named `read_file`\n\nor `search_files`\n\nthat accept dynamic file path parameters from LLMs and pass them directly to `open()`\n\nwithout checking if the target path resides within an allowed root.\n\n`../../etc/passwd`\n\n).\n\n```\ntarget = (ALLOWED_ROOT / user_path).resolve()\nif not target.is_relative_to(ALLOWED_ROOT):\n    raise PermissionError(\"Path traversal attempt detected\")\n```\n\n`subprocess.run(shell=True)`\n\nand `child_process.exec()`\n\n. Always pass arguments as explicit string arrays.If you maintain an MCP server or use them in production, you can test your repository for these exact vulnerabilities without running untrusted code on your machine:\n\n👉 [MCP Security & Vulnerability Auditor on Apify Store](https://apify.com/neon_innovation_lab/mcp-security-auditor)\n\nDrop in your public GitHub repository URL, and it generates a complete Trust Score (0–100) and actionable remediation report.", "url": "https://wpnews.pro/news/show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke", "canonical_source": "https://dev.to/neoninnovationlab/show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke-f1l", "published_at": "2026-09-04 11:21:33+00:00", "updated_at": "2026-09-04 11:54:29.959830+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-infrastructure", "developer-tools"], "entities": ["Model Context Protocol", "Anthropic", "FastMCP", "Slack MCP Server", "Brave Search MCP", "Apify"], "alternates": {"html": "https://wpnews.pro/news/show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke", "markdown": "https://wpnews.pro/news/show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke.md", "text": "https://wpnews.pro/news/show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke.txt", "jsonld": "https://wpnews.pro/news/show-hn-we-scanned-23-public-mcp-servers-for-cves-here-is-what-broke.jsonld"}}