MCP: 40% of Servers Vulnerable According to Lakera

In just one year, MCP servers have become the preferred interface between AI agents and external systems, but they also represent a critical entry point for attackers. Specific threats have been identified, and 40% of the evaluated servers exhibited vulnerabilities. Companies like Check Point, Cisco, and TrueFoundry are deploying safeguards, but these protections only address part of the problem.

MCP Threats: 40% of Servers Exhibit Weaknesses

OWASP has identified several major risks for MCP servers. Tool poisoning involves inserting malicious instructions into descriptions, schemas, or return values to manipulate the agent's behavior. Rug pull attacks modify a tool's definition after its approval, exploiting the trust placed in it. Tool shadowing and inter-origin escalation use tool descriptions from a malicious server to influence the use of tools hosted on a trusted server. Lakera, an AI security company acquired by Check Point in 2025, analyzed 10,000 MCP servers and found that 40% had exploitable weaknesses. Other attack vectors exist, such as data exfiltration via legitimate tool calls (searches, emails) or granting broader permissions than necessary, increasing exposure. These vulnerabilities are far from rare.

AI Firewalls and Controls: Responses Already Available

Various market players are marketing solutions that take into account the role of MCP servers within AI architectures. TrueFoundry offers governance features for infrastructure, access management, and auditing of exchanges between MCP tools and agents through AI Gateway. Cisco has enhanced AI Defense by adding agent-focused protection devices, MCP analysis, and continuous monitoring of MCP traffic to identify and prevent risky behaviors. Check Point favors a network-oriented strategy: its AI network firewall combines AI security with the existing firewall infrastructure, supports communications involving employees, applications, and agents via MCP, as well as other links between AI systems and external resources, identifies MCP servers, analyzes their traffic, and implements access rules. The term "AI firewall" encompasses two distinct concepts: one refers to a firewall using AI to protect a network against traditional attacks, while the other concerns securing the AI itself against query injection and data loss. Check Point's product, launched in July 2026, falls into this second category.

Adoption: MCP Supported by Clouds and Major Platforms

Anthropic launched MCP as an open standard in November 2024. In December 2025, the company announced that over 10,000 public MCP servers were active, with deployment support from AWS, Google Cloud, Azure, and other providers. MCP is used by major platforms and coding assistants, including ChatGPT, Gemini, Microsoft Copilot, Cursor, and Visual Studio Code. The standard has become the preferred connection between AI agents and tools or data in less than twelve months, and by that date, it equipped all major coding assistants as well as most LLMs. Its adoption curve has surpassed that of many infrastructure standards, which remains rare in a highly competitive sector.

A Unique Interface That Also Opens an Attack Surface

The main advantage of MCP is to provide a unique and secure interface for connecting agents, assistants, and development tools to multiple services and data sources without relying on specific connectors. However, this pooling introduces a new attack surface. The speed of MCP adoption outpaces the available defenses, and existing AI protections were not designed for dynamic access to sensitive systems. Research highlights the extent of the gap. The need for specialized firewalls for AI is particularly focused on MCP servers, which have become the fastest-growing infrastructure element that these protections must address, while security solutions struggle to keep up.

Securing MCP Is Not Enough: Integrate Defense with the Rest of the Stack

Securing MCP servers is necessary but does not cover the entirety of agent security. The connection via MCP is just one access point to tools and data, and agents can interact with other systems without MCP. Securing MCP helps limit tool poisoning, unauthorized access, and data leaks, but it is not sufficient to ensure overall security. Companies must examine MCP offerings within a broader framework, assess their effectiveness against MCP-specific risks, and verify their integration with the rest of the security stack, as additional controls will remain essential. As is often the case during rapid infrastructure evolutions, security lags behind: several approaches coexist – AI-sensitive network firewalls, infrastructure governance, dedicated safeguards. The main challenge is to bridge the gap before a targeted attack on MCP necessitates a constrained response.