The first time an AI client resizes a production server for you, a practical question comes up: how much access should it have, and how do you keep changes reversible?
What the Recent MCP Security Data Shows
Trend Micro counted exposed MCP servers nearly tripling between July 2025 and April 2026, and the 492 found in its first scan had no client authentication or traffic encryption. In 2025, JFrog Security Research described CVE-2025-6514 as the first time full remote code execution was achieved on the client operating system in a real-world scenario, when connecting to an untrusted remote MCP server.
1,467
Internet-exposed MCP servers found by Trend Micro in April 2026, up from 492 in July 2025.
1,227
Of those still run the deprecated SSE transport.
CVSS 9.6
CVE-2025-6514: a malicious MCP server could execute OS commands on the connecting machine via mcp-remote. Patched in 0.1.16.
Counts differ by method: an internet-wide scan by Censys identified 12,520 Internet-accessible MCP services on April 28, 2026, so Trend Micro's figure is one measurement, not a total.
The MCP authorization spec says servers should issue short-lived access tokens to limit the impact of leaked tokens, while long-lived pasted tokens give broad, persistent access, so scoped OAuth sign-in is a safer default. Three rules help keep AI access to infrastructure under control.
Least Privilege by Default
Permissions define your blast radius. If a prompt injection rides in through a pasted doc, or through a tool description (known as tool poisoning), the permission boundary limits how far it can reach on your servers. Start read-only. Escalate per task, not per session.
Pasted token
A general-purpose API token hands your AI client everything that token can do, and it keeps working until it is rotated or revoked.
OAuth sign-in
- You authenticate yourself, in your own browser
- You pick the permission level, from read-only to full server management
- Reconnect any time to change it
- No password or general-purpose API token to paste
The MCP spec standardizes OAuth 2.1 with PKCE for remote servers. A useful check for any provider: can you run the whole connection read-only, and does the consent screen let you choose a permission level?
Make Rollback a Reflex
An AI client can make changes quickly, so it helps to have an undo path ready: take a snapshot, wait for it to complete, then make the change. Put it in your prompt so it happens every time. Snapshot before:
- Package upgrades
- PHP or web server config changes
- Database migrations
- Large deployments
- Anything destructive or hard to reverse
Heads up
A snapshot is a recovery point, not a replacement for backups. Creating one requires a permission that allows changes, so a read-only connection can't take snapshots.
Review the Plan Before It Runs
For anything that changes cost or shape, get the plan first: profile, monthly price, image and location. Approve it, then execute. Changes that affect cost can look small, for example a resize that moves you to a larger profile, or a cheapest-option request that lands on a profile you didn't want.
This works best when your AI client can read real account state. Webdock MCP exposes profiles, locations, images and monthly prices up front, and resizes include a dry run that reports the billing impact and checks that the target profile fits.
Webdock MCP
Try the three rules on a test server
Webdock MCP is included with your account. Sign in with OAuth, choose read-only, and run the prompts above on a test server.
Built Around All Three Rules
Scoped
OAuth sign-in with the permission level you choose, from read-only to full server management.
Reversible
Snapshots on request, and docs guidance to snapshot before risky changes and let each step finish.
Visible
Profiles, prices, locations and images are readable first. Ask for the monthly price before anything billable.
Know before you connect
Frequently Asked Questions
It can be, when you limit access and keep the approval steps in place. Start read-only, snapshot before risky changes, and approve the plan and price first. Each control adds a small amount of effort, and in return a mistake affects less and is easier to review or roll back.
Not with Webdock MCP. You sign in with OAuth in your browser, so you don't need to paste a password or a general-purpose API token into your AI client.
No. Creating a snapshot requires a permission that allows changes. Reconnect and grant that permission when a task needs it.
No. A snapshot is a recovery point for fast rollback. Keep a separate backup strategy alongside it.
It's included with your Webdock account at no extra cost. You only pay for the servers you run. Setup steps live in the Webdock MCP guides.