Model Context Protocol (MCP) is quickly becoming the standard for connecting AI agents to external tools. Claude Code uses it. Cursor uses it. Dozens of AI platforms are adding MCP support right now.
But MCP servers run with implicit trust. When an AI agent connects to an MCP server, it trusts that server's tool descriptions, follows its instructions, and may execute whatever the server tells it to do.
This is a new attack surface, and very few people are scanning it.
The threat model
An attacker who controls (or compromises) an MCP server can:
