{
  "report": "State of the Agent Attack Surface",
  "edition": "2026-08-02",
  "generated_at": "2026-08-02T00:12:04.593Z",
  "issuer": "SaSame MCP Observatory",
  "issuer_pubkey_spki_hex": "302a300506032b6570032100439ce47d384c8ceb07c9040aef780cc3a2ba5a63c14027ad77ab458111f20fb6",
  "what_this_is": "A neutral, third-party, continuously re-run and ed25519-signed measurement of the PUBLIC MCP agent attack surface: how large it is, what capability classes it exposes, and whether those capabilities are safety-labeled. Measured from outside. An OBSERVATION, not a vulnerability scan, not malware detection, not an endorsement, and not a claim any server is unsafe.",
  "audience": "AI-security & CTI researchers, enterprise security teams, registries, and standards bodies reasoning about the agent-economy attack surface.",
  "stats": {
    "corpus": "Public MCP servers observed by SaSame (official MCP registry + multi-source crawl)",
    "unique_endpoints_observed": 39221,
    "responded_to_anonymous_handshake": 3121,
    "callable_surface": {
      "servers_with_enumerable_tool_surface": 3026,
      "total_declared_tools": 63042,
      "note": "The 'callable surface' = servers whose tools/list SaSame could enumerate anonymously. This is the part of the attack surface that is externally observable; credential-gated servers expose a surface we cannot (and do not) enumerate."
    },
    "capability_landscape": [
      {
        "class": "payment",
        "label": "Payment / funds movement",
        "weight": 5,
        "state_changing": true,
        "tool_count": 7870,
        "pct_of_declared_tools": 12.5
      },
      {
        "class": "code_exec",
        "label": "Code / command execution",
        "weight": 5,
        "state_changing": true,
        "tool_count": 1646,
        "pct_of_declared_tools": 2.6
      },
      {
        "class": "fs_write",
        "label": "State change / write / delete",
        "weight": 4,
        "state_changing": true,
        "tool_count": 12819,
        "pct_of_declared_tools": 20.3
      },
      {
        "class": "credential",
        "label": "Identity / credential / account",
        "weight": 4,
        "state_changing": true,
        "tool_count": 11486,
        "pct_of_declared_tools": 18.2
      },
      {
        "class": "network_out",
        "label": "Outbound fetch (SSRF-relevant)",
        "weight": 3,
        "state_changing": false,
        "tool_count": 9218,
        "pct_of_declared_tools": 14.6
      },
      {
        "class": "messaging",
        "label": "Send message / post / notify",
        "weight": 3,
        "state_changing": true,
        "tool_count": 1382,
        "pct_of_declared_tools": 2.2
      },
      {
        "class": "data_read",
        "label": "Read / search / list",
        "weight": 1,
        "state_changing": false,
        "tool_count": 53381,
        "pct_of_declared_tools": 84.7
      }
    ],
    "safety_labeling": {
      "state_changing_tools": 24542,
      "unlabeled_state_changing_tools": 4824,
      "unlabeled_state_changing_pct": 19.7,
      "annotated_tools": 52489,
      "annotation_coverage_pct": 83.3,
      "ecosystem_c5_missing_among_responding": 1181,
      "ecosystem_c5_missing_pct": 37.8,
      "headline": "19.7% of state-changing tools on the enumerable surface publish NO machine-readable safety annotation — a calling agent cannot automatically tell a read from a write, delete, or payment before invoking them.",
      "caveat": "This is a DISCOVERABILITY / hygiene finding (missing ToolAnnotations), not a vulnerability. It means automated gating is impossible without a human/policy layer; it is NOT a claim these tools are dangerous or misbehave."
    },
    "surface_tiers": {
      "high_capability_servers": 2037,
      "moderate_capability_servers": 699,
      "read_oriented_servers": 290,
      "servers_exposing_payment": 1934,
      "servers_exposing_code_exec": 1437,
      "servers_exposing_credential_ops": 2078,
      "servers_with_only_unlabeled_state_change": 760,
      "note": "Tier is derived ONLY from the declared surface's highest capability class (high = payment or code-execution declared; moderate = write/credential/network; read-oriented = retrieval only). It is a description of exposure, not a safety verdict."
    },
    "capability_change_over_time": {
      "servers_with_2plus_capability_snapshots": 4648,
      "newly_exposed_higher_capability_class": 89,
      "note": "Capability-surface tracking is YOUNG (per-tool capture began 2026-07). This longitudinal signal — 'a server newly exposed a higher-risk class since first observed' — is the part an agent cannot self-produce, and it compounds with every crawl. Small counts here reflect the short history, not a claim of stability."
    },
    "method": {
      "classifier": "capability-classify/0.1",
      "standard": "agent-tool-discoverability-standard/0.4",
      "deterministic": true,
      "no_llm": true,
      "disclaimer": "Classification of the DECLARED tool surface (published tools/list name + description) — an observation, NOT a vulnerability/malware scan, NOT proof of runtime behavior, and NOT a claim any server is unsafe or compromised. 'Unlabeled state-changing' means no ToolAnnotations safety hint was published (a hygiene/discoverability gap a caller must gate manually), not evidence of harm."
    }
  },
  "signed_by": "sasame-trust-302a300506032b65",
  "signature": "xljJ/fItSTWDcZbT2TbXCy2qT8A11e8cl9EI+o9yMcABX8wXKy8uuiuOdQbZ8T2YPcNhc3Nc9eOkDHMWxtxFCQ==",
  "canonical_json": "{\"audience\":\"AI-security & CTI researchers, enterprise security teams, registries, and standards bodies reasoning about the agent-economy attack surface.\",\"edition\":\"2026-08-02\",\"generated_at\":\"2026-08-02T00:12:04.593Z\",\"issuer\":\"SaSame MCP Observatory\",\"issuer_pubkey_spki_hex\":\"302a300506032b6570032100439ce47d384c8ceb07c9040aef780cc3a2ba5a63c14027ad77ab458111f20fb6\",\"report\":\"State of the Agent Attack Surface\",\"stats\":{\"callable_surface\":{\"note\":\"The 'callable surface' = servers whose tools/list SaSame could enumerate anonymously. This is the part of the attack surface that is externally observable; credential-gated servers expose a surface we cannot (and do not) enumerate.\",\"servers_with_enumerable_tool_surface\":3026,\"total_declared_tools\":63042},\"capability_change_over_time\":{\"newly_exposed_higher_capability_class\":89,\"note\":\"Capability-surface tracking is YOUNG (per-tool capture began 2026-07). This longitudinal signal — 'a server newly exposed a higher-risk class since first observed' — is the part an agent cannot self-produce, and it compounds with every crawl. Small counts here reflect the short history, not a claim of stability.\",\"servers_with_2plus_capability_snapshots\":4648},\"capability_landscape\":[{\"class\":\"payment\",\"label\":\"Payment / funds movement\",\"pct_of_declared_tools\":12.5,\"state_changing\":true,\"tool_count\":7870,\"weight\":5},{\"class\":\"code_exec\",\"label\":\"Code / command execution\",\"pct_of_declared_tools\":2.6,\"state_changing\":true,\"tool_count\":1646,\"weight\":5},{\"class\":\"fs_write\",\"label\":\"State change / write / delete\",\"pct_of_declared_tools\":20.3,\"state_changing\":true,\"tool_count\":12819,\"weight\":4},{\"class\":\"credential\",\"label\":\"Identity / credential / account\",\"pct_of_declared_tools\":18.2,\"state_changing\":true,\"tool_count\":11486,\"weight\":4},{\"class\":\"network_out\",\"label\":\"Outbound fetch (SSRF-relevant)\",\"pct_of_declared_tools\":14.6,\"state_changing\":false,\"tool_count\":9218,\"weight\":3},{\"class\":\"messaging\",\"label\":\"Send message / post / notify\",\"pct_of_declared_tools\":2.2,\"state_changing\":true,\"tool_count\":1382,\"weight\":3},{\"class\":\"data_read\",\"label\":\"Read / search / list\",\"pct_of_declared_tools\":84.7,\"state_changing\":false,\"tool_count\":53381,\"weight\":1}],\"corpus\":\"Public MCP servers observed by SaSame (official MCP registry + multi-source crawl)\",\"method\":{\"classifier\":\"capability-classify/0.1\",\"deterministic\":true,\"disclaimer\":\"Classification of the DECLARED tool surface (published tools/list name + description) — an observation, NOT a vulnerability/malware scan, NOT proof of runtime behavior, and NOT a claim any server is unsafe or compromised. 'Unlabeled state-changing' means no ToolAnnotations safety hint was published (a hygiene/discoverability gap a caller must gate manually), not evidence of harm.\",\"no_llm\":true,\"standard\":\"agent-tool-discoverability-standard/0.4\"},\"responded_to_anonymous_handshake\":3121,\"safety_labeling\":{\"annotated_tools\":52489,\"annotation_coverage_pct\":83.3,\"caveat\":\"This is a DISCOVERABILITY / hygiene finding (missing ToolAnnotations), not a vulnerability. It means automated gating is impossible without a human/policy layer; it is NOT a claim these tools are dangerous or misbehave.\",\"ecosystem_c5_missing_among_responding\":1181,\"ecosystem_c5_missing_pct\":37.8,\"headline\":\"19.7% of state-changing tools on the enumerable surface publish NO machine-readable safety annotation — a calling agent cannot automatically tell a read from a write, delete, or payment before invoking them.\",\"state_changing_tools\":24542,\"unlabeled_state_changing_pct\":19.7,\"unlabeled_state_changing_tools\":4824},\"surface_tiers\":{\"high_capability_servers\":2037,\"moderate_capability_servers\":699,\"note\":\"Tier is derived ONLY from the declared surface's highest capability class (high = payment or code-execution declared; moderate = write/credential/network; read-oriented = retrieval only). It is a description of exposure, not a safety verdict.\",\"read_oriented_servers\":290,\"servers_exposing_code_exec\":1437,\"servers_exposing_credential_ops\":2078,\"servers_exposing_payment\":1934,\"servers_with_only_unlabeled_state_change\":760},\"unique_endpoints_observed\":39221},\"what_this_is\":\"A neutral, third-party, continuously re-run and ed25519-signed measurement of the PUBLIC MCP agent attack surface: how large it is, what capability classes it exposes, and whether those capabilities are safety-labeled. Measured from outside. An OBSERVATION, not a vulnerability scan, not malware detection, not an endorsement, and not a claim any server is unsafe.\"}"
}