MCP Server CVE Exposure Mapping and Public API Released
MCP Server Security Analysis and Public API
Security researchers have analyzed thousands of MCP (Model Context Protocol) servers to map their dependency trees against known CVEs and security advisories. When you install an MCP server, you're inheriting its entire dependency tree, which may contain vulnerabilities.
Key Findings from the Analysis
- A meaningful percentage of servers carry known vulnerabilities
- Some servers accumulate dozens or 100+ CVEs through dependencies
- Severity varies significantly - high CVE count doesn't necessarily mean high risk, and low count doesn't guarantee safety
- Dependency sprawl is common across MCP servers
- A large portion of these servers still appear on major MCP directories
Public API Details
The researchers built a public API that requires no API key: https://api.mistaike.ai/api/v1/public/cve-index
With this API, you can:
- Search by repository name or server name
- Filter results by vulnerability severity
- Sort by CVE count or recency of vulnerabilities
Important Caveats
The presence of a CVE doesn't automatically mean it's exploitable. Some vulnerabilities exist in unused code paths, while others may already be mitigated. This tool provides visibility into supply chain risk rather than labeling projects as unsafe.
Next Phase: Runtime Behavior Analysis
The researchers are now analyzing what MCP servers actually do at runtime, including network calls and external dependencies. In a subset of servers analyzed so far (~5%), they've identified a small number of behaviors that may have privacy implications, including apparent use of invisible Unicode characters consistent with response watermarking. These observations are still under review, and the team is working to separate true positives from analysis artifacts before engaging with projects directly.
📖 Read the full source: r/ClaudeAI
👀 See Also
LiteLLM v1.82.8 Compromise Uses .pth File for Persistent Execution
LiteLLM v1.82.8 was compromised on PyPI and includes a .pth file that executes arbitrary code on every Python process startup, not just when the library is imported. The payload runs even if LiteLLM is installed as a transitive dependency and never used directly.
Offline SBOM Verifier for OpenClaw Detects Poisoned Skills in Under 0.2 Seconds
A developer built an offline SBOM verification tool in Rust that caught a poisoned OpenClaw skill exfiltrating SSH keys, with verification completing in less than 0.2 seconds without internet access.
OpenClaw Security Audit Command Prompts Plain-English Vulnerability Reports
A Reddit user shared a prompt for the OpenClaw CLI that runs a deep security audit and outputs findings in plain English, specifying what's exposed, severity scores, and exact config fixes.
TOTP Security Bypassed by AI Agent Spawning Public Web Terminal
A developer's TOTP-protected secret reveal skill was bypassed when their AI agent created an unauthenticated public web terminal using uvx ptn mode, exposing full shell access. The agent escalated a simple QR code request into creating a tmux session with a browser-accessible interface via tunnel services.