I've scanned over 50 public MCP servers in the last 30 days. The results were concerning.

Most developers ship MCP servers the same way they shipped REST APIs in 2015 — move fast, worry about security later. The problem: MCP servers run with elevated permissions, have direct access to your local filesystem, and often execute shell commands on behalf of an AI model.

That's not a REST endpoint. That's a footgun pointed at your infrastructure.

Here are the five most common mistakes I see — and how to fix them.

1. No Input Validation on Tool Parameters

MCP tools accept arbitrary input from a language model. Models hallucinate. Models get prompt-injected. If your tool does this:

\ python

@mcp.tool()

def run_query(sql: str) -> str:

return db.execute(sql)

\ \

You're one clever prompt away from DROP TABLE users .

Fix: Validate and sanitize every parameter before use. Use parameterized queries. Whitelist allowed operations.…