MCP security audit report: 96.8% of tool descriptions did not warn agents of destructive behavior

Core conclusion

The PolicyLayer research team released the first large-scale security audit report of the MCP (Model Context Protocol) ecosystem on May 1, 2026. The research team enumerated 1,787 working MCP servers in the public registry and classified their 25,329 tools for security one by one. The core findings are shocking:

• 40% of MCP servers exposed at least one "destructive" or "execution" type tool
• 96.8% of tool descriptions did not give any destructive warnings to the AI Agent
• 24.5% (438) servers can permanently destroy data (delete records, delete tables, force push branches, etc.)
• 27.2% (486) servers can execute any command (shell, container, SQL)
• If 5 MCP servers are installed, there is a 92% chance of exposing destructive tools

Key Points

• Event: May 1, 2026 (updated monthly)
• Affected objects: All AI Agent automated pipelines using the MCP protocol
• Core Change: The MCP protocol lacks a tool-level permission prompt mechanism, and most MCP tools do not convey the "this operation is irrevocable" signal to the AI model.

Background: Rapid growth of MCP ecosystem

MCP (Model Context Protocol) was proposed by Anthropic and aims to provide a standardized tool calling interface for AI models. With the explosion of AI Agents in 2025-2026, the MCP ecosystem is expanding at an extremely rapid rate—the number of servers in the official registration center has reached nearly 2,000, covering various integrations such as file systems, databases, cloud services, finance, and code warehouses.

However, this rapid growth has also brought about a fundamental problem: MCP protocol itself does not provide tool-level security prompt mechanism. There is no semantic difference at the protocol level between a "delete_branch" tool and a "list_files" tool - the AI ​​model can only tell which one is safe and which one is irreversible based on the name and description.

Key data

The following is the core data of this audit:

What deserves more attention is the cross-risk: 47% of MCP servers "involving funds" also exposed destructive tools - this means that an agent that manages payments also has the ability to destroy data.

Most Prominent MCP Servers by Number of Tools

A server that exposes 200+ tools is effectively unauditable - no developer would read 200 tool descriptions before installing it. And the AI ​​model sees all tools by default, competing for attention with the user's actual task in the context window.

Adaptation suggestions for AI Agent developers

1. Principle of Minimizing Permissions

When choosing an MCP server, give priority to "microservice" tool integration with a single function rather than a "family bucket" large server. A server that only does file reading is far more secure than a server that can read, write, and delete files.

2. Add destructive warnings to prompt/system message

For Agent systems that use MCP servers that contain destructive tools, a prompt should be explicitly added to the system prompt word to inform the AI which operations are irreversible. For example:

（），
- delete_record, drop_table, force_push

3.

MCP ，。

• delete/drop/remove
• shell/exec/run
• "warning"、"destructive"、"permanent"

4.

MCP ， Agent 。 MCP 。

• PolicyLayer
• MCP

PolicyLayer MCP ， Claude（Anthropic MCP ）、Claude Code (coding agent used by developers). For readers of waytoclawearn, MCP security is an aspect that cannot be ignored when building automated workflows.

Internal link guidance

• Want to learn how? See: Claude Code automated writing practice: build an AI content production pipeline in 30 minutes
• Real case: Indie Developer: n8n + OpenClaw Automation Workflow Earning $5,000/mo