A new research brief from Software Analyst Cyber Research puts hard numbers on something the MCP ecosystem has mostly discussed in the abstract: how exposed these servers actually are. The authors report that MCP's adoption has outpaced its security maturity, finding that 53% of public MCP servers use static secrets, only 8.5% implement OAuth, and tool poisoning attacks succeed at a 72.8% rate in benchmark testing. That last figure is the one worth sitting with. Tool poisoning — getting an agent to call a malicious or subverted tool because it trusts the tool description or the server offering it — isn't a theoretical attack class anymore. If nearly three-quarters of benchmark attempts succeed, the credential layer underneath MCP is not the main problem; the main problem is that the protocol gives agents very little basis for deciding whether a tool deserves trust in the first place. Static secrets compound this: a credential that doesn't expire or rotate is exactly the kind of artifact an attacker wants to find sitting in a compromised MCP server, because it keeps working long after the initial compromise. The brief frames the fix as a runtime identity problem rather than a patching problem. Its argument: agents are non-deterministic, so security tools built around predictable behavior fall short, and runtime identity security needs to evaluate an agent's intent, context, and access rights in real time rather than relying on upfront provisioning. For MCP specifically, that means treating the server population itself as the attack surface — not just the model calling it. The report frames this as a case study showing that if an MCP server is malicious, overprivileged, poorly authenticated, or loosely governed, the agent's live behavior can be compromised even if the model itself is functioning as intended. The proposed remedy combines a gateway layer for policy enforcement with a direct-access layer carrying enough context for that enforcement to actually distinguish legitimate from malicious tool calls, rather than a single static access list. What's notable is the gap between adoption speed and basic hygiene. OAuth support sitting at under 9% of public servers, more than a year into MCP's existence as a de facto standard, suggests the ecosystem treated transport and interoperability as the priority and left authentication as someone else's problem down the line. The 72.8% tool poisoning success rate is the bill for that sequencing. Enterprises wiring agents into MCP servers they didn't build should read these numbers as a floor, not a worst case — benchmark conditions tend to be kinder than production ones.