The CVE counter hit 30 before Valentine's Day
The first CVE for an MCP server dropped on January 3. By February 14, the count was past thirty. I found that out while I was still debugging why my new MCP server had handed an AI agent a raw WHOIS record with a typo-squatted registrar name, and the agent treated it like gospel.
That server wrapped my Portfolio Investigate API as an MCP tool. One call returns a domain dossier: WHOIS, IP geolocation, company data, email reputation, sanctions screening, a plain-English verdict, and a natural-language POST /ask endpoint. I thought I was just wrapping a REST API. I was actually building an attack surface.
{
"name": "investigate_domain",
