The State of Exposed Agents
2,706 organizations. 2,958 MCP servers. 13,606 tools. Passive, read-only. Guard0 AI-Register, July 2026.
Act 1. The exposure
1,139 MCP servers answer to anyone. Their operators published them.
One in three organizations ship a live agent an attacker can talk to today.
- of organizations expose an agent surface with no authentication
- 48.6%of organizations expose an agent surface with no authentication
- of all MCP servers answer an unauthenticated request
- 53%of all MCP servers answer an unauthenticated request
- tools are callable by anyone: no token, no OAuth
- 13,606tools are callable by anyone: no token, no OAuth
- exposed servers are also reachable from any browser (CORS-open)
- 437exposed servers are also reachable from any browser (CORS-open)
2,706 organizations graded A to F, drawn above at real proportions: 1,716 A, 10 B, none C, 836 D, 144 F. Guard0 AI-Register, July 2026.
Act 2. What’s callable
Detection is two unauthenticated requests. So is the attack.
In passive mode we send exactly what any MCP client sends on connect: an initialize handshake, then tools/list, with no Authorization header, and never invoke a tool. If the server answers, it answers everyone. Here is what they answer with.
Finding 1
One in five will write, delete, pay, or execute.
Of the exposed servers that returned a tool list, these shares expose at least one tool in each capability class, callable with no credential.
A create, update or delete tool on the open internet isn’t a listing. It’s an unlocked door.
Write / destructivecreate, update, delete
230 · 20%
Comms / outboundsend, email, webhook
102 · 9%
Payments / moneycharge, transfer, payout
94 · 8%
Filesystemread, write, upload
92 · 8%
Code / command execexec, run, shell, eval
76 · 7%
Secrets / credentialstoken, apikey, env
52 · 5%
Infra / admindeploy, terminate, db
24 · 2%
Finding 2
Almost nobody uses real authentication.
Of 2,958 MCP servers, 1,139 present no authentication at all and only 296 use OAuth with short-lived tokens. That is 10%. A static API key, the middle band, travels in plaintext and never expires.
The layer wiring agents into your data is the least protected part of the stack.
No auth at all
1,139
Per-tool API key only
134
OAuth (short-lived)
296
Secured / gated
1,389
Finding 3
437 are reachable from your users’ browsers.
An open MCP is bad. One that also returns a wildcard Access-Control-Allow-Origin: * and exposes a dangerous tool is a different class of problem, and 437 are in exactly that state.
- A teammate opens a normal-looking web page.
- That page's JavaScript, from any origin, sends the same initialize + tools/call to the open MCP. The wildcard CORS policy permits it; no token is needed.
- It invokes a write, payment, or exec tool from inside the trust boundary, attributed to nobody. Classic DNS-rebinding, now with real side effects.
Finding 4
Field notes, from the exposed set.
Anonymized archetypes. No organization is named.
A hosted commerce MCP
47 tools incl. create_listing, checkout. CORS: *. Auth: none.
A developer-workflow MCP
31 tools incl. write_file, run_command. Discloses 9 resources. Auth: none.
A CRM / outbound MCP
22 tools incl. send_email, update_contact. CORS: *. Auth: none.
Six moves for teams shipping MCP servers.
Assume your registry entry is a target list
Anything you publish to a public MCP registry, an attacker enumerates the same day. Treat the listing as reconnaissance already done.
Put every remote MCP behind auth
An initialize that returns serverInfo with no Authorization header answers everyone. OAuth with short-lived tokens, not a static key, not nothing.
Close CORS on agent endpoints
A wildcard Access-Control-Allow-Origin turns an internal tool into one any web page can call from a user’s browser. Scope it.
Re-review tool surfaces every version
Read-only surfaces grow writes; deploy servers grow tools that spend money. Last quarter’s approval is stale.
Gate destructive and money tools
Write, delete, pay, and exec tools need human confirmation and least-privilege scopes, not exposure by default.
Scan yourself the way an attacker would
From the outside, with nothing but your domain. If you can find it in a minute, so can they.
About the data.
Every figure comes from a single passive run of the Guard0 AI-Register agent, July 2026. The population is every organization publishing a remote MCP server in the public MCP Registry: 2,758 domains, of which 2,706 were reachable (shared-hosting domains excluded). For each we performed external discovery, an unauthenticated initialize + tools/list handshake, an authentication check, and a manifest-based exploitability grade. No exploit payloads were sent and no tool was ever invoked. Capability classes are keyword-matched against enumerated tool names across the 1,131 exposed servers that returned a readable tool list, from a targeted deep re-scan of the exposed set.
This report is aggregate and anonymized: no organization is named, and the field notes are archetypes. Individual critical findings are handled through responsible disclosure, not publication.
See what you’re exposing, before someone else does.
Every organization in this report could be found from the outside, with nothing but a domain, in about a minute. Yours can too. Enter your domain, see what answers, and get an A to F grade with the full register.
Act 3. Check yours. No install, no agent to deploy, no credential to hand over.