A dev left an MCP server wired to prod for 5 months and I only just found it, so much for mcp security
Was clearing out dead namespaces in staging on then came across one I did not recognise. Turned out to be an MCP server. Took me a bit to work out one of the backend guys spun it up in March so his Cursor agent could poke at our internal APIs, then moved on and forgot it was still running.
Still running. Still had a live token on it. I sat there for a second just looking at it.
It was not even a new one, he had grabbed an existing CI service account because it was handy and that account can get into the staging database. Our staging is a full clone of prod, so that is customer data sitting behind a server none of us knew existed. Scanners never flagged it, the container itself is clean, nothing wrong with the image. The problem is a server that should not exist having a key to data it should never touch.
How many more are there, and how would I ever know. We pin our actions and pick apart every dependency and a whole category that can act on its own walked straight past all of it. How are you all keeping track of the MCP servers your devs spin up?