Every infrastructure security discipline starts in the same place, and it is not the expensive tool. It is the list. CSPM began as cloud resource inventory. Vulnerability management begins with asset inventory. MCP security will be no different, and almost nobody has done that part.
The scale of what is loose
Public numbers already give the shape of it. Censys counted more than 12,000 internet-accessible MCP services, most of them unauthenticated. Trend Micro's July 2025 scan found 492 servers exposed with no authentication or encryption — and a later scan counted 1,467. The official MCP registry passed 9,600 records by May 2026, and roughly 20,000 related repositories exist on GitHub.
Those are the ones on the internet. The ones that should worry you more are the others: the one started on a developer's laptop, the one in the staging cluster, the one in a container nobody documented. Shadow AI is not a metaphor — it is the default state.
Where to look
A first inventory is cheaper than it sounds. Four sources cover most of it:
- Client configuration files. MCP clients keep their server list as JSON in the user profile. Searching for those files across managed endpoints reveals what each person has plugged in.
- Repositories. Look for MCP SDK dependencies in package manifests. GitGuardian reported 24,008 unique secrets exposed in MCP-related configuration files on public GitHub — which tells you those files are findable by naming pattern.
- Processes and ports. On hosts running agents, list processes speaking the protocol and the ports they listen on. stdio transport opens no port, so network scanning alone will undercount.
- Egress. DNS and outbound connection logs surface agents calling third-party servers nobody approved.
What to record per server
A server name is not enough. The field that determines risk is which tools it exposes and what each one does. Record: transport, whether authentication is required, which tools write to disk, execute commands or make network calls, which identity it runs as, and who the human owner is.
A read-only server and a command-executing server show the same icon in the client UI and carry completely different risk.
Why do this before buying a tool
There is an understandable reflex to wait for the market to produce an MCP posture scanner. But even once it exists, the first thing it will ask for is the list of targets. Teams that already hold the inventory gain months; teams that do not will start from zero, only now with a paid licence.
Start with a spreadsheet. It is embarrassing and it works.
