In a disturbing trend that’s been gaining momentum on the internet, a coordinated effort is underway to scan for exposed Model Context Protocol (MCP) servers and AI assistant credentials. This widespread scanning campaign has been detected by cybersecurity researchers who analyzed logs from a small web host over a two-week period.
The researchers discovered that alongside the usual suspects – WordPress xmlrpc floods, .env probing, and Git config fishing – there’s a new category of scanning that’s been added to the mix. Someone is systematically searching for MCP servers, AI assistant configuration files, and locally exposed Large Language Model (LLM) endpoints on unsuspecting websites.
At first glance, this might seem like an isolated incident, but upon closer inspection, it appears to be a distributed scan with a large number of source IPs involved. This suggests that we’re dealing with a mature campaign rather than a one-off curiosity or the work of a single researcher.
The most striking aspect of this scanning effort is that it’s not just a simple case of requesting URLs and checking status codes. The scanners are actually speaking the MCP protocol, sending correctly formed handshakes to see if the target server responds like an MCP server. If the server does respond, the next steps would likely involve enumerating the tools and data sources exposed by the server, as well as any potential actions that can be taken.
For those who may not be familiar with MCP servers, they’re essentially the bridge between AI agents and external systems. They allow models to access databases, file systems, ticketing systems, and internal APIs. An exposed and unauthenticated MCP server is a recipe for disaster, offering a remote, machine-readable menu of everything an agent can touch.
In addition to searching for live servers, the scanners are also fishing aggressively for configuration and credential files belonging to AI coding assistants like Claude and Cursor. These tools write sensitive settings and credentials to project or home directories, which can be accidentally deployed to web roots, leaking sensitive information.
The paths requested by these scanners are specific and up-to-date, indicating that someone has recently built a wordlist based on real knowledge of how these tools store their settings. The use of HEAD requests for credential files is also an efficiency optimization typically seen in large-scale scanning campaigns.
What this means for internet users is that they need to be vigilant about securing their MCP servers and AI assistant credentials. This includes implementing proper authentication mechanisms, regularly reviewing server logs for suspicious activity, and being mindful of sensitive settings and credentials stored on web-facing systems. By taking these precautions, we can mitigate the risks associated with exposed MCP servers and prevent potential breaches.
Source: SANS ISC — 2026-07-13