When was the last time you checked what your MCP server actually exposes to the internet? Not what you intended it to expose. What it actually does, right now, with the config you shipped three sprints ago.
I ask because I did exactly that last month on a side project, and the answer was embarrassing. A local dev MCP server I’d spun up to test a tool-calling loop was still running, still bound to 0.0.0.0, and still had no auth because I’d been in a hurry and auth is annoying. That’s one bot builder being sloppy. The 2026 numbers suggest I’m not alone: independent scans found more than 12,000 MCP servers reachable from the public internet, and roughly 40% of them had no authentication at all.
Why this got bad so fast
MCP won. That’s the honest read on where things stand. After a stretch where nobody was sure whether it would stick, adoption turned routine rather than experimental. It’s the default way to give an agent standardized access to tools and data sources, and it’s more widely adopted than A2A for exactly that reason. Teams picked their stack and moved on.
Winning is the problem. The design flaws disclosed in April 2026 aren’t one bad implementation you can patch and forget. They’re systemic, and they ride along a supply chain that covers more than 150 million package downloads, with an estimated 200,000 vulnerable instances out there. Among them, the critical Flowise remote code execution bug and the STDIO command injection issue that OX Security disclosed. STDIO is the part that stings for me personally, because that’s the transport most of us reach for first. It’s the easy local option. It’s what every tutorial starts with, including some I’ve written.
The part builders keep missing
Here’s what I think trips people up, and I say this as someone who wires these systems together for a living rather than auditing them.
Protocols have no memory. MCP and A2A are stateless communication standards. They move messages. They don’t track what an agent did, what data it touched, or where the output went. There’s no built-in ledger. So when you connect agent to agent and let them negotiate work between themselves, you’ve built a system where the interesting behavior happens in the gaps between calls, and nothing in the protocol is watching those gaps.
When I’m debugging a single agent, I can read the trace. Request in, tool call out, response back. Reason about it. When I chain three agents and let them pass tasks around, I lose that. Not because the tooling is bad, but because no layer in the stack is responsible for the whole story. The protocol is doing its job perfectly while the system does something I never designed.
What I changed in my own builds
None of this is fancy. It’s the stuff I skipped when I was moving fast, and now I don’t.
- Audit what’s listening. Scan your own hosts. Any MCP server bound to a public interface needs a reason to exist, and “I was testing something” is not one.
- Auth is not optional for agent-to-agent. If two of your agents talk over MCP, that channel needs credentials. The 40%-no-auth figure exists because this step feels like overhead on a system you think is internal.
- Pin and review your dependencies. A supply chain spanning 150 million downloads means your exposure is mostly inherited. Pin exact versions. Know what you pulled in.
- Treat STDIO as a trust boundary. Command injection through STDIO works because we hand strings to a shell and assume the strings are ours. Validate inputs crossing that line, every time.
- Log at the orchestration layer. Since the protocol won’t track state, you have to. Give every agent-to-agent handoff an ID, record what was requested and what came back, and keep it somewhere you can query.
Solid beats clever
The thing I keep coming back to is that MCP isn’t the villain in this story. It’s a good standard that solved a real mess. In 2024, every agent framework had its own tool-calling convention and its own coordination mechanism. That chaos resolved into structure quickly, and MCP did most of that work. The cost of a standard winning is that its weak points become everyone’s weak points simultaneously.
Agent-to-agent communication is where I’d focus attention if you’re shipping anything this year. Single-agent setups have a human reviewing the loop somewhere. Multi-agent setups are specifically designed to remove that human, and we’re building them on a transport layer that doesn’t remember what happened. That gap is the risk, and it’s not going to close on its own.
Go check your servers. I’ll wait.
🕒 Published: