Pluto Operation:MCP: 147 of 179 Internet-Facing MCP Servers Accepted Unauthenticated tools/call (Root Shells to Citizen Registries)

Pluto Security (Avishai Gonen, Ehud Melzer) published on 24 September 2026 the results of Operation:MCP internet scanning: 179 confirmed exposed MCP server deployments, of which 147 (82%) accepted unauthenticated requests with no login, token, or session check. Manual severity across the corpus: 26 critical, 19 high, 24 medium, 110 low; 140 were still live at publication. Impact classes among servers with full tool visibility included write/state-changing tools (57), read-only (43), financial/commerce (23), and full code execution (7). Concrete cases (redacted in the write-up, disclosed to operators/NCSC) included root `exec` on production boxes with plaintext Stripe/GitHub/AWS keys in the environment, a nine-figure digital media company's unauthenticated 30-tool server exposing private report buckets, production SQL, CMS/paywall writes and subscriber export, and a Swiss municipal citizen-administration MCP (`ags-daemon`) that accepted unauthenticated `ags_anliegen` calls keyed on AHV (national social-insurance) numbers for passport/ID/residence workflows — disclosed to Switzerland's NCSC and closed. Pluto stresses there is no novel exploit: MCP `tools/list` is commonly unauthenticated by design, so finding privileged servers is a search problem (e.g. Shodan facets), and binding shell or data-plane tools to 0.0.0.0 without authenticating `tools/call` is the recurring mistake. Geography of the 179: US 89, Germany 22, China 11, Canada 10, Japan 8.

You are affected if you run Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/call (and often bind beyond localhost). Any coding agent or IDE configured to talk to such a server inherits the server's privileges..

Inventory every MCP endpoint reachable from outside the laptop loopback: authenticate tools/call (discovery/tools/list can stay open; execution and data retrieval must not), authorize per tool rather than per server, and bind listeners to localhost or a private network unless there is a deliberate reverse-proxy with auth in front. Scan your own external attack surface for MCP fingerprints before attackers do. Treat any MCP server that wraps exec, SQL, CMS writes, or citizen/PII workflows as a Tier-0 interface — same identity, authorization, and logging you would demand of an admin API. If you unexpectedly ran an MCP server on 0.0.0.0 during a demo, shut it down and rotate every secret that process could read. Prefer allowlisted local stdio MCP servers over ad-hoc remote HTTP/SSE endpoints for developer agents.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c and which version, then enforce a policy on it.