The Model Context Protocol is becoming the standard way AI agents connect to external tools. Meta's Ads MCP server — used by thousands of marketing teams — had a vulnerability that allowed unauthenticated execution of tool commands via HTTP.
What Happened
GitHub Advisory GHSA-2026-0612 disclosed that the Meta Ads MCP server accepted tool execution requests without authentication. Any HTTP client on the network could invoke ad campaign modifications, budget changes, or data exports. No API key required.
Why This Matters for Framework Teams
MCP servers are the new plugins. WordPress had 60,000 plugins and accumulated 18,005 CVEs. The MCP ecosystem is younger but growing faster — and repeating the same pattern: convenience first, authentication later.
FastAPI scores 95/100 on AI-Readiness precisely because it enforces structured API contracts — authentication, validation, type safety — by default. MCP servers that skip these fundamentals will reproduce the WordPress plugin security crisis at AI agent scale.
The Takeaway
Every organization deploying MCP tools should audit authentication on every endpoint. The AI tool supply chain is the new frontier — and unauthenticated execution is the new open admin panel.
