Guard0 AI-Register · Passive mode · July 2026
The State of Exposed Agents
We ran our AI-Register agent in passive mode against every organization publishing a remote MCP server in the public registry, and asked one question of each: does it hand its tools to anyone who asks?
Act 01 · The exposure
1,139 MCP servers answer to anyone. Their operators published them.
48.6%
of organizations expose an agent surface with no authentication
53%
of all MCP servers answer an unauthenticated request
13,606
tools are callable by anyone — no token, no OAuth
437
exposed servers are also reachable from any browser (CORS-open)
2,706 organizations graded A–F · Guard0 AI-Register, July 2026
Act 02 · What’s callable
Detection is two unauthenticated requests. So is the attack.
In passive mode we send exactly what any MCP client sends on connect — an initialize handshake, then tools/list, with no Authorization header, and never invoke a tool. If the server answers, it answers everyone. Here is what they answer with.
Finding 01
One in five will write, delete, pay, or execute.
Of the exposed servers that returned a tool list, these shares expose at least one tool in each capability class — callable with no credential.
A create/update/delete tool on the open internet isn’t a listing. It’s an unlocked door.
Share of 1,131 tool-listing exposed servers · Guard0 AI-Register, July 2026
Finding 02
Almost nobody uses real authentication.
Of 2,958 MCP servers, 1,139 present no authentication at all and only 296 use OAuth with short-lived tokens. A static API key — the middle band — travels in plaintext and never expires.
The layer wiring agents into your data is the least protected part of the stack.
2,958 MCP servers reached · Guard0 AI-Register, July 2026
Finding 03
437 are reachable from your users’ browsers.
An open MCP is bad. One that also returns a wildcard Access-Control-Allow-Origin: * and exposes a dangerous tool is a different class of problem — and 437 are in exactly that state.
- 1A teammate opens a normal-looking web page.
- 2That page's JavaScript — from any origin — sends the same initialize + tools/call to the open MCP. The wildcard CORS policy permits it; no token is needed.
- 3It invokes a write, payment, or exec tool from inside the trust boundary, attributed to nobody. Classic DNS-rebinding, now with real side effects.
Finding 04
Field notes, from the exposed set.
A hosted commerce MCP
47 tools incl. create_listing, checkout · CORS: * · auth: none
A developer-workflow MCP
31 tools incl. write_file, run_command · discloses 9 resources · auth: none
A CRM / outbound MCP
22 tools incl. send_email, update_contact · CORS: * · auth: none
Anonymized archetypes · no organization is named
The playbook
Six moves for teams shipping MCP servers.
Assume your registry entry is a target list
Anything you publish to a public MCP registry, an attacker enumerates the same day. Treat the listing as reconnaissance already done.
Put every remote MCP behind auth
An initialize that returns serverInfo with no Authorization header answers everyone. OAuth with short-lived tokens, not a static key, not nothing.
Close CORS on agent endpoints
A wildcard Access-Control-Allow-Origin turns an internal tool into one any web page can call from a user’s browser. Scope it.
Re-review tool surfaces every version
Read-only surfaces grow writes; deploy servers grow tools that spend money. Last quarter’s approval is stale.
Gate destructive and money tools
Write, delete, pay, and exec tools need human confirmation and least-privilege scopes — not exposure by default.
Scan yourself the way an attacker would
From the outside, with nothing but your domain. If you can find it in a minute, so can they.
Act 03 · Check yours
Every organization in this report could be found from the outside, with nothing but a domain, in about a minute. Yours can too — the only question is who looks first.
Enter your domain
No install, no agent to deploy, no credential to hand over. Just the domain.
See what answers
Every subdomain, agent, MCP, and model endpoint that responds on the open internet.
Get your grade
An A–F exposure grade and the full register — every endpoint, its tools, its posture.
See what you’re exposing. Before someone else does.
About the data
Every figure comes from a single passive run of the Guard0 AI-Register agent, July 2026. The population is every organization publishing a remote MCP server in the public MCP Registry — 2,758 domains, of which 2,706 were reachable (shared-hosting domains excluded). For each we performed external discovery, an unauthenticated initialize + tools/list handshake, an authentication check, and a manifest-based exploitability grade. No exploit payloads were sent and no tool was ever invoked. Capability classes are keyword-matched against enumerated tool names across the 1,131 exposed servers that returned a readable tool list, from a targeted deep re-scan of the exposed set.
This report is aggregate and anonymized: no organization is named, and the field notes are archetypes. Individual critical findings are handled through responsible disclosure, not publication.