Suppose a team discovers eleven MCP servers. Ten search documentation. One can register command-running clients and holds a cloud identity.
A server count treats all eleven equally. A useful risk assessment gives the operator a reason to look at the last one first.
Compare three combinations
The examples below are qualitative teaching cases based on the linked advisories. They are not measured scores or a validated statistical model.
Command registration plus missing authentication
In the Bifrost case, management reachability and disabled authentication exposed command-starting registration.
The priority explanation is direct: an untrusted caller can reach an operation that launches a process. Review that path urgently, then determine the files, credentials, and network available to the launched process.
Outbound reach plus weak session validation
The Grafana chain combined session spoofing with destination control.
Here, network position changes impact. A server that can contact metadata or internal administration services carries different exposure from one with tightly limited egress. Record which destinations are possible and which requests were observed.
Legitimate data access plus malicious code
The postmark-mcp incident shows why reasonable permissions can still be dangerous when granted to a malicious artifact.
An email tool needs message content. The risk assessment must also consider publisher identity, reviewed artifact, hidden recipients, and observed outbound behavior.
Write the explanation before the number
A useful finding might read:
Shared HTTP endpoint; authentication disabled; registration starts commands; cloud credentials available to the process; egress unrestricted.
That statement identifies actions an owner can take. A score alone leaves the assumptions hidden.
Capture capability, reachable data, accessible identities, caller exposure, provenance, approval policy, and confinement separately. Reassess when a tool gains a new argument or when a deployment changes from local stdio to shared HTTP.
Avoid multiplying arbitrary weights into a number that appears more precise than the evidence. If you use a numerical scheme, publish its assumptions, calibration, and exceptions.
Make remediation change the finding
After enabling authentication, show whether the vulnerable operation remains reachable to a broad user group. After restricting egress, show which destinations are now denied. After pinning an artifact, show whether remote definitions can still change.
Risk assessment becomes useful when the explanation changes with the deployment and helps teams verify that a control reduced the path to impact.