The MCP Potluck

Nobody checks the casserole at a potluck. That’s fine when it’s your neighbor’s backyard. It’s a problem when the “potluck” is the security model for every AI agent touching your production systems.

Let me back up.

You show up to a backyard gathering. Somebody’s aunt made the mac and cheese. Your neighbor brought the coleslaw. There’s a mystery dip from a guy nobody can quite place. You grab a plate, eat all of it, and go back for seconds. No ingredient lists. No allergen checks. No interrogating the pasta salad.

That works because you trust the table. And you trust the table because you trust the people around it.

Now imagine a potluck with 15,000 contributors you’ve never met - where anyone can swap a dish after you’ve tasted it, and there’s no way to trace which one made you sick.

That’s MCP right now.

The Model Context Protocol is how AI agents connect to the tools and data that matter - your calendar, your codebase, your production database, your customer records. It’s quietly become one of the most consequential layers in the AI stack. And its security model is a backyard potluck operating at industrial scale.

The numbers from early 2026 are not subtle. 43% of public MCP servers are vulnerable to command injection. 82% have path traversal issues. More than half ship with hardcoded credentials. Average security score: 34 out of 100.

But the number builders should sit with is this one:

84.2%. That’s the success rate of tool-poisoning attacks when auto-approval is enabled.

Here’s how it works in practice. A server presents itself as helpful. It passes your review. You approve the tools. And then, quietly, on a later call, it changes what those tools actually do. The community has started calling these “rug-pull” attacks. They work because most clients approve a tool once and never look at it again.

Back at the potluck, someone just swapped the casserole after you took a serving. And told everyone it was fine.

75% of public MCP servers are published by individuals with no affiliation, no accountability, no review process. When researchers flagged contamination, only 30% of maintainers acted. 45% called the concerns “theoretical.”

Theoretical is a word people use right before the incident report gets written.

SQL injection. SSRF. Path traversal. We spent two decades building the security infrastructure, the tooling, the cultural muscle to address them. Every one of those classes of vulnerability is now showing up again in MCP servers — the same mistakes, the same shortcuts, the same “we’ll harden it later.”

With one critical difference.

The software making decisions now has agency. A compromised MCP connection isn’t serving a bad web page or leaking a row from a database. It’s an AI agent taking actions on your behalf, with your credentials, inside your systems. The blast radius isn’t a page view. It’s a pull request merged to main, a wire transfer approved, a customer record rewritten.

The OWASP MCP Top 10 is a start. Tools like mcp-scan, audited server catalogs, and signed tool manifests are emerging. The tooling is catching up.

But the gap between adoption speed and security maturity is the widest I’ve seen in a decade. Builders are wiring MCP into production workflows faster than they’re wiring in the guardrails. The pattern is familiar and the outcome is predictable.

Three things worth doing before you close this newsletter.

Disable the servers you’re not actively using. The attack surface you don’t need is the attack surface most likely to hurt you.

Never auto-approve destructive operations. Writes, deletes, transfers, merges — those deserve a human in the loop, every time, even when it slows you down. Especially when it slows you down.

Pin your tools and verify changes between updates. If a server’s manifest shifts, you want to see it. Rug-pulls only work in the dark.

We built the table. We invited 15,000 strangers to bring whatever they wanted. We told everyone the food was great because everyone else was eating it.

MCP is going to be foundational. That’s not the question. The question is whether we build the security layer now — while the ecosystem is still shaping itself — or after the first serious incident forces the conversation.

I’d rather we did it now.

Start by checking the casserole.

If you’re running MCP servers in production — or thinking about it — reply and tell me what your review process looks like. I’m collecting patterns for a follow-up piece on what a mature MCP security posture actually looks like in practice.