Scanning Public MCP Servers for Security Vulnerabilities with WARDEN

Description and use

The authors of @aimarket/warden scanned 1,108 public MCP servers and found 4 servers with malicious tools requesting private keys. Initially, 50 servers were blocked, but after refining the ruleset to v4, false positives dropped to 2. The tool helps protect agents from secret leakage.

Problem

The public Model Context Protocol (MCP) registry contains a significant attack surface where agents blindly trust tool definitions. There was no visibility into how many public servers contained malicious or insecure tool definitions, such as those requesting private keys or credentials.

Outcome

Out of 1,108 scanned MCP servers, 4 were found to contain tools that explicitly requested sensitive material like private keys or credentials. The initial scanner had a high false-positive rate (46 false blocks), which was reduced to 2 false blocks in ruleset v4 through improved context analysis.

Workflow

• Fetch registry rows and filter for unique servers with remote endpoints.
• Attempt connection using streamable-http with a 20s timeout.
• Request tool definitions via the tools/list endpoint.
• Analyze tool schemas and descriptions using WARDEN ruleset.
• Apply context-aware guards (polarity, mention, detection) to reduce false positives.
• Block servers that match critical security findings (e.g., requesting private keys).
• Publish findings and update rulesets based on false positive analysis.

Evidence

We scanned 1,108 public MCP servers. WARDEN blocked 50 — only 4 were real.

Source

Four of the fifty blocks describe tools that really do move secret material through the model's context

Source

Ruleset v4 is in @aimarket/warden 0.4.0... servers blocked 50 down to 6, four substantiated findings unchanged

Source