EXPOSURE MCP
SEVERITY CRITICAL
PROBE GET :3000/sse
Is your MCP exposed?
Built local, deployed public by accident. Strangers calling your tools, not just reading data.
Scan a host you own → Fix card Census
Why it matters
Your MCP server answers anyone on the internet — via an open SSE/HTTP transport, a public /messages/ session surface, a /.well-known MCP discovery card, or a static tools catalog on that card (the GET equivalent of unauthenticated tools/list). MCP servers are built for local use and ship with no auth by default; once public, strangers can discover and often CALL your tools (files, shell, databases — whatever the server exposes). That is anonymous tool execution, not just information disclosure.
How common is it?
A published population estimate for MCP is still collecting. See the census methodology.
Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.
Fix it
The full walkthrough lives on the fix card, kept current in one place: