State of the Agent Attack Surface

Name: State of the Agent Attack Surface
Creator: SaSame MCP Observatory
License: https://live-vps.sasame.online/observatory/

An independent, continuously re-run, ed25519-signed measurement of the public MCP agent attack surface. Measured from outside — a third-party observation, not a vulnerability scan, not malware detection, and not a claim any server is unsafe. Edition 2026-09-16 · classifier capability-classify/0.1 · standard agent-tool-discoverability-standard/0.4.

52.6% of state-changing tools on the enumerable surface publish NO machine-readable safety annotation — a calling agent cannot automatically tell a read from a write, delete, or payment before invoking them.

Classification of the DECLARED tool surface (published tools/list name + description) — an observation, NOT a vulnerability/malware scan, NOT proof of runtime behavior, and NOT a claim any server is unsafe or compromised. 'Unlabeled state-changing' means no ToolAnnotations safety hint was published (a hygiene/discoverability gap a caller must gate manually), not evidence of harm.

The externally-observable surface

57,123 unique public MCP endpoints observed.
8,725 answered an anonymous MCP handshake at measurement time.
7,512 exposed a tool surface SaSame could enumerate anonymously — 129,962 declared tools in total. That enumerable set is the attack surface this report characterises.

Capability landscape (declared tools)

Class	What it can do	Kind	Tools	% of declared
`payment`	Payment / funds movement	state-changing	12551	9.7%
`code_exec`	Code / command execution	state-changing	3088	2.4%
`credential`	Identity / credential / account	state-changing	16104	12.4%
`fs_write`	State change / write / delete	state-changing	14267	11%
`network_out`	Outbound fetch (SSRF-relevant)	read	34225	26.3%
`messaging`	Send message / post / notify	state-changing	3170	2.4%
`data_read`	Read / search / list	read	104761	80.6%

Safety labeling of state-changing capability

37,308 declared tools are state-changing (write / delete / payment / credential / send / execute).
19,623 of them (52.6%) publish no machine-readable safety annotation.
Ecosystem-wide, 70.2% of responding servers miss the safety-annotation criterion (C5).

This is a DISCOVERABILITY / hygiene finding (missing ToolAnnotations), not a vulnerability. It means automated gating is impossible without a human/policy layer; it is NOT a claim these tools are dangerous or misbehave.

Exposure tiers

High-capability servers (declare payment or code-execution): 4639
Moderate-capability (write / credential / outbound-fetch): 2004
Read-oriented: 869

Tier is derived ONLY from the declared surface's highest capability class (high = payment or code-execution declared; moderate = write/credential/network; read-oriented = retrieval only). It is a description of exposure, not a safety verdict.

Capability change over time

10267 servers now have 2+ capability snapshots; 316 newly exposed a higher-risk class since first observed. Capability-surface tracking is YOUNG (per-tool capture began 2026-07). This longitudinal signal — 'a server newly exposed a higher-risk class since first observed' — is the part an agent cannot self-produce, and it compounds with every crawl. Small counts here reflect the short history, not a claim of stability.

Verify it yourself

ed25519-signed, offline-verifiable, reproducible. Issuer pubkey 302a300506032b6570032100439ce47d…. Re-run the audit + classifier against any server to reproduce it — no callback to SaSame required.

SaSame MCP Observatory — a neutral, third-party measurement layer for the AI agent economy. Capability classes are observations of the declared surface, never safety, malware, or trust verdicts. Corrections & delistings: consulting@srl-sasame.com. Per-server defensive pre-call checks are available over MCP (capability_profile) — aggregate report never names individual servers.