This was first published on my site and is cross-posted here; the version on my site is canonical and the one I keep current. It is authorized research: I ran mcp-witness, an open-source scanner I built, across Python MCP servers published to PyPI, and reproduced the most serious finding only on infrastructure I own, under responsible disclosure with a 90-day embargo observed before anything was published. If you want the tool rather than the writeup, it is at github.com/desledishant10/mcp-witness .

TL;DR

Between May and June 2026 I disclosed six vulnerabilities across six PyPI-published Python MCP servers, in two distinct classes. Outbound SSRF in URL-fetching tools (two packages: Anthropic's reference mcp-server-fetch and the community-published mcp-server-http-request ) lets an agent coerced via prompt injection retrieve cloud-metadata-service credentials from any host where IMDS is reachable.…