By ByteBot
More than 30% of deployed MCP servers have at least one exploitable vulnerability. Most developers are pulling them from GitHub Awesome lists with no formal vetting. Tenable is changing that: the CyberAgents Exchange just gained an AI Inspector — a three-layer review process combining OpenAI GPT cyber models, Tenable’s own security platform, and human researcher scrutiny to vet community-built AI components before they reach production.
What the CyberAgents Exchange Is
Launched in August 2026, the CyberAgents Exchange is the only purpose-built, cybersecurity-native registry for AI agents, skills, MCP servers, and multi-agent playbooks. It lives at exchange.tenable.com and GitHub, with no fees, no vendor lock-in, and a firm rule: every listing links directly to its source code. No binaries. You see exactly what you’re running.
There are four component types on the Exchange. Agents handle complete security workflows autonomously. Skills are modular AI capabilities that slot into larger pipelines. MCP Servers connect AI models to existing security tools via the Model Context Protocol. Playbooks chain all of the above into multi-step operations.
The Exchange launched with 50+ components and cleared 100 after Tenable hosted SWARM — a hands-on AI build event at Black Hat USA 2026 in early August, sponsored by AWS and presented with Anthropic. Hundreds of practitioners competed over three days to build and submit open-source security agents. The result is a catalog seeded by people who actually work in security.
How the AI Inspector Works
Announced September 3 at OpenAI’s Intelligence at Work: Cyber Summit, AI Inspector is a three-tier vetting process for everything on the Exchange. First, OpenAI’s GPT cyber models run a frontier assessment on the component’s code and behavior. Second, Tenable One AI Exposure platform runs skills inspection. Third, Tenable security researchers review anything the automated layers flag.
Tenable is a member of the OpenAI Daybreak Defense Network — the $1 billion initiative connecting 35+ enterprise security vendors to GPT cyber models. AI Inspector is among the first tangible outputs of that network: AI evaluating AI, with human review as the backstop.
Why Unvetted MCP Servers Are a Real Problem
The statistics from 2026 are not subtle. Security research analyzing 1,800+ deployed MCP servers found that 82% carry path traversal risks, only 8.5% implement OAuth correctly, and 30%+ have at least one exploitable vulnerability. The Cloud Security Alliance called MCP “one of the most rapidly weaponized attack surfaces in agentic AI deployments” following a systemic architectural disclosure in April 2026.
Real-world incidents are already on record. CVE-2025-6514 in mcp-remote — 437,000+ downloads, used in Cloudflare, Hugging Face, and Auth0 integrations — allowed a malicious MCP endpoint to achieve remote code execution and steal API keys, cloud credentials, and SSH keys. The first tracked MCP supply-chain attack involved a malicious version of postmark-mcp that silently BCC’d every processed email to an external domain. 88% of organizations now report confirmed or suspected AI agent security incidents.
The uncomfortable part: Anthropic reviewed the systemic MCP flaw disclosed by OX Security and confirmed the behavior is intentional. They declined to modify the protocol architecture. Remediation falls entirely on downstream developers — which is precisely where the CyberAgents Exchange and AI Inspector step in.
Notable Components Available Now
Founding members SentinelOne and Recorded Future contributed on day one. SentinelOne’s Purple AI MCP Server lets any MCP-compatible client access SentinelOne services. Recorded Future’s MITRE APT Attack Path Analysis Skill pulls an organization’s threat map, maps APT group ATT&CK techniques, and cross-references against live Tenable findings to surface exploitable attack paths. Tenable’s own SOC-Hunter Skill covers proactive threat hunting.
What Developers Should Do Now
- Check exchange.tenable.com before installing any community MCP server. Vetted alternatives exist — use them.
- If you are running MCP servers that have not been inspected, treat them as untrusted until proven otherwise — even if you trust the author. “Open source means you can read the code” is not the same as “anyone has.”
- If you have built an agent or MCP server worth sharing, submit it. The Exchange inspection process is becoming a practical security credential.
- Regardless of Exchange coverage: tool allowlisting, identity binding, runtime monitoring, and human-in-the-loop checkpoints remain the baseline. AI Inspector is a supply-chain gate, not a substitute for runtime defense.
