The team at Zuplo made an observation that stuck with me: after a long stretch of people wondering whether MCP would stick, it has settled into something normal. Adoption stopped being experimental and turned routine.
That line reads like good news. For a protocol review, it’s the scariest sentence in the whole category. “Routine” is how infrastructure stops getting audited. It’s the moment a thing moves from the “we’re testing this” column to the “it’s just part of the stack” column, and nobody re-reads the config.
Then April 2026 happened.
What the disclosures actually found
Systemic design flaws in the Model Context Protocol were disclosed in April 2026, and the numbers attached to them are not the kind you file under “monitor and revisit next quarter”:
- An estimated 200,000 vulnerable instances
- A supply chain covering more than 150 million package downloads
- Over 12,000 MCP servers found exposed to the public internet in independent 2026 scans
- Roughly 40% of those running with no authentication at all
Two specific items anchor the rest: the critical remote code execution vulnerability in Flowise, and the STDIO command injection vulnerability disclosed by OX Security. The second one is the part I’d flag hardest in a review, because STDIO isn’t an exotic edge case. It’s the default local transport. It’s the thing you use when you’re wiring an agent to a tool on your own machine and you assume “local” means “safe.”
Four thousand-odd servers sitting on the open internet with no auth is not a protocol problem in the narrow sense. That’s a deployment culture problem. But protocols shape deployment culture, and a spec that makes the unauthenticated path the easy path will get exactly the deployments you’d predict.
The agent-to-agent part is where it gets worse
MCP was designed for standardized access to tools and data sources, and it remains the more widely adopted protocol for agentic systems built around that use case. That’s its actual job. A2A exists for agent coordination specifically.
The problem is that teams use what’s already in the stack. If MCP is sitting there, already working, already “normal,” it becomes the pipe that agents talk to each other through, whether or not that’s what it was built for. Nobody files a design doc for that decision. It just happens on a Tuesday because the connection already exists.
And here’s the structural issue nobody can patch their way out of: MCP and A2A are stateless communication standards. Protocols have no memory. They don’t track what an agent did, what data it accessed, or how its outputs were used.
Read that against enterprise governance requirements and the gap is obvious. When one agent calls a tool, you can at least point at the tool’s logs. When agent A hands something to agent B, which hands it to agent C, which touches a data source, the protocol carrying those messages has no idea any of it happened. There’s no built-in audit trail because audit trails were never the spec’s problem.
Why this review reads differently from most
I normally judge a toolkit on whether it does the thing it claims. MCP does. It’s a decent standard for connecting agents to tools, which is why adoption went the way it did. The failure isn’t capability.
The failure is that it got adopted at a speed that outran the operational practices around it, and the April 2026 disclosures describe design flaws, not configuration mistakes. The 150 million package downloads figure is the one that should bother you most, because that’s reach. A systemic flaw in something with that distribution isn’t a bug you fix in your repo. You’re waiting on a chain of maintainers you’ve never met.
What I’d actually do about it
Nothing clever here, just the things that would have prevented most of the 12,000:
- Audit every MCP server you run for internet exposure. Not “the ones we deployed on purpose.” All of them.
- Assume anything with no authentication is already compromised and work backward from there.
- Treat STDIO as an untrusted boundary. The OX Security disclosure takes away the “it’s local, it’s fine” assumption permanently.
- Check your dependency tree against the Flowise RCE and the broader supply chain footprint.
- Build your own logging layer for agent-to-agent traffic. The protocol will not do it for you, and if your compliance story depends on it, you don’t have a compliance story.
The protocol space sorted itself out fast. In 2024, every framework had its own tool-calling convention and its own coordination mechanism. Standardization was the right outcome. It also means a single set of design flaws now reaches 200,000 instances instead of fragmenting across a dozen incompatible stacks.
That’s the trade nobody priced in when MCP became normal. Standards concentrate risk as efficiently as they concentrate convenience, and most teams running MCP today have only been keeping score on the second one.
đź•’ Published: