Announcing MCP Toolbox Java SDK v1.0: Agentic data access for the enterprise
cloud.google.com·6d ago
Cloud & Infrastructure
The New Stack·Sep 10·5 min read
Researchers found that 1 in 5 MCP access policies came back broken or missing
TL;DR
Researchers discovered that 20% of Model Context Protocol (MCP) access policies were either broken or missing, highlighting significant security vulnerabilities. This raises concerns about the reliability of tools built on these policies, such as those used in corporate environments.
✦ Why It Matters
Review and validate your access policies to ensure they meet updated security standards.
Key Takeaways
- Audit your MCP access policies for broken or missing entries.
- Implement a token rotation schedule for all API keys.
- Ensure proper logging of all access and actions taken by tools.
- Educate teams on issuer validation and secure token management.
Full Summary
A recent study found that over 20% of access policies related to the Model Context Protocol (MCP) were either broken or missing, indicating serious security flaws. The MCP, which governs authorization for AI integrations, underwent a significant update in July 2026, acknowledging failures in its original trust model.
Researchers tested 45 live MCP servers and found a 36.5% average attack success rate, with some models performing even worse. Many tools, like a scheduling application built by a finance employee, operate using static tokens that are rarely rotated and often lack proper logging.
This situation leaves organizations vulnerable, as they cannot track what these tools can access or when credentials were last updated. The findings suggest a pressing need for better governance and oversight of AI integrations to prevent potential security incidents.