143,000 Flaws Across 25,000 MCP Servers: Anaconda Buys Enkrypt

Anaconda acquired Enkrypt AI on August 4, 2026, and the number buried in the announcement is the one security teams keep re-reading: Enkrypt says that in the two months before the deal it scanned more than 268,000 tools across 25,000 MCP servers and found more than 143,000 vulnerabilities affecting 73% of those servers.

Read that as a vendor claim, because that is what it is. Every scan figure here comes from Enkrypt AI by way of the Anaconda press release, with no published methodology, no severity breakdown, and no independent reproduction. What makes it interesting is not precision. It is that roughly three of every four Model Context Protocol servers Enkrypt could reach had at least one flagged weakness, and almost no enterprise can currently prove otherwise about its own fleet.

What Anaconda Actually Bought on August 4, 2026

Enkrypt AI is an AI security and compliance product that scans models, agents, and MCP servers for hidden risk and then enforces guardrails on them at runtime. The acquisition was announced from Austin, Texas, and the product is vendor-neutral and cloud-agnostic rather than tied to one model provider.

Anaconda CEO David DeSanto framed the purchase around sign-off rather than detection, arguing enterprises already run AI-native applications containing exploitable weaknesses they cannot easily see. Enkrypt co-founder and CEO Sahil Agarwal made the sharper point: there is a difference between running AI and running AI safely, and trust cannot be bolted on after an agent ships.

Practical details for current users: Enkrypt remains available with no announced changes to products, plans, or support. It is an OpenAI compliance integration partner, giving ChatGPT Enterprise customers turnkey audit and guardrail controls, and equivalent Anthropic support is listed as coming soon.

The 73% Number, Read Carefully

The 73% figure means that within Enkrypt's own two-month scan window, roughly three of every four MCP servers it examined had at least one flagged finding. The arithmetic makes the shape clearer: 143,000 findings across 268,000 tools is about 0.53 findings per tool, and 73% of 25,000 servers is roughly 18,250 affected servers, which works out to about 7.8 findings per affected server.

That clustering is the tell. Density like that usually means systemic defaults rather than exotic bugs, and a template flaw copied across forks of a popular server gets counted once per fork. Here is what the release gives us against what it withholds.

Two caveats matter before this lands in a board deck. The reachable population of MCP servers skews toward public registry listings and side projects, so a census of it is not a census of enterprise production. And without a definition of vulnerability, the count likely mixes remote-exploit paths with weak defaults and over-broad permissions, which carry very different urgency.

None of that makes the direction wrong. If you have not inventoried your MCP servers, your real number is unknown, and unknown is worse than 73%.

What Actually Goes Wrong on an MCP Server

MCP server risk is not one bug class, it is at least seven, each with a different owner inside an engineering organization. A scanner finding is only actionable once you know which team fixes it.

Notice how few of these are memory-safety bugs. Most are authorization and trust-boundary mistakes, which is what happens when a protocol reaches production faster than the governance around it. The prompt-injection half of this problem gets fuller treatment in our writeup of Anthropic guidance on not trusting AI agents by default.

Why Anaconda Wanted a Security Layer

Enkrypt is the third acquisition in a platform Anaconda has been assembling in pieces. Outerbounds added production-grade orchestration, Kilo Code added the agentic engineering environment where builders work, and Enkrypt adds security, governance, and compliance over both. Anaconda wants the whole path, from the first prompt a developer types to the model, agent, and MCP server running in production.

That is coherent for this company, because Anaconda has never really sold Python. It sold the decision about which build of a package an enterprise may install. Curating open source artifacts is a trust business, and trust businesses expand by adding artifact types: packages, then models, then agents, then MCP servers.

The competitive read: AI security is consolidating into platforms before most buyers finished evaluating point tools. A CISO facing four separate purchases will usually take three of them from whoever already sits in the build pipeline.

The Enterprise Python Supply-Chain Angle

Anaconda's distribution advantage is that its trust decisions already sit inside enterprise build pipelines, a very different starting position from a standalone scanner. The company cites 95% of the Fortune 500 as customers, including Panasonic, AmTrust, and Booz Allen Hamilton, along with 52 million users and 21 billion downloads.

Those numbers explain the deal better than the vulnerability count does. Anaconda is not entering AI security from nothing, it is widening an existing gate. If you already block a package version at install time, the same control plane can plausibly block a model or an MCP server.

The gap it targets is specific. Software composition analysis and SBOMs answer what code you shipped. Neither answers what your agent is permitted to do at 2am when a tool description tells it to read a file it has never touched. Package provenance is static; tool permission is a runtime property, and Python shops have mature tooling for the first and almost nothing for the second.

Compliance Mapping: NIST AI RMF and the EU AI Act

Enkrypt's compliance pitch is that it turns framework text into controls that execute automatically, covering the NIST AI Risk Management Framework, the EU AI Act, and industry-specific regulation. That framing matters because most AI governance work today produces documents, not enforcement.

The timing is not accidental. EU AI Act transparency obligations under Article 50 took effect August 2, 2026, two days before this acquisition was announced, as covered in our Article 50 developer compliance checklist. NIST AI RMF remains voluntary, but it appears in procurement questionnaires and federal-adjacent contracts, which is where voluntary frameworks acquire teeth.

For teams building these controls rather than buying them, our enterprise LLM security checklist covering MCP, OAuth, and EU AI Act obligations maps the same ground without a vendor dependency.

Our Analysis: What Platform Teams Should Do This Quarter

1. Separate the signal from the denominator. Treat 73% as directional evidence that MCP hygiene is bad in the wild, and as useless for estimating your own exposure. Yours is a function of which servers your agents can reach, not of what a vendor found on the public internet.

2. Build the inventory before you buy the scanner. Most enterprises cannot say how many MCP servers are reachable from their agent runtimes, who wrote them, or what token each one holds. A scanner pointed at an unknown fleet produces findings nobody owns. An allowlist with three approved servers produces security.

3. Use the protocol change as a chokepoint. The stateless MCP 2026-07-28 specification makes requests routable on Mcp-Method and Mcp-Name headers without parsing bodies. That gives you a gateway that can log, rate-limit, and deny by tool name, which is the enforcement point any guardrail product needs to be worth paying for.

4. Price guardrails as inference, not as software. Runtime classifiers and safety checks are extra model calls on the hot path of every agent action. Model that overhead against your current per-token costs with our LLM API pricing tracker before routing production traffic through a scanning proxy.

5. Expect packaging to change even though pricing did not. Enkrypt is standalone and unchanged today, but the obvious commercial path is an Anaconda Platform security tier. Anyone renewing in the next two quarters should ask about bundling terms now. And if your agent stack is Claude-first, the unshipped Anthropic integration is your evaluation blocker, not the vulnerability count.

MCP Server Validation Checklist

Before you approve any server

• [ ] Identify the author, repository, and whether the server is pinned to an immutable version or resolved at runtime
• [ ] Read every tool description and JSON Schema field as untrusted input, checking for embedded instructions
• [ ] Enumerate the exact scopes on the token the server holds, then cut them to the narrowest tool that needs them
• [ ] Confirm the transport binding: loopback only or exposed, and whether authentication exists independent of network position
• [ ] Check whether any read tool and any network tool on the same server can be chained into an egress path

On an ongoing basis

• [ ] Diff tool definitions on every deploy and alert on changes to descriptions, not just code
• [ ] Log every tool call with caller identity, tool name, and arguments, retained for incident review
• [ ] Rotate server credentials on the same schedule as any other production service account
• [ ] Re-review any server whose upstream repository changes ownership or maintainers

Quarterly

• [ ] Reconcile the reachable server list against the approved allowlist and remove drift
• [ ] Sample-audit agent transcripts for tool calls no human intended
• [ ] Re-map controls after any NIST AI RMF or Article 50 revision

Key Takeaways

• August 4, 2026: Anaconda announced its acquisition of Enkrypt AI, adding security, governance, and compliance to a platform already extended by the Outerbounds and Kilo Code deals.
• 268,000 tools, 25,000 servers, 143,000+ findings, 73% affected — all vendor-reported by Enkrypt AI over a two-month window, with no published severity split, sampling method, or independent reproduction.
• About 7.8 findings per affected server by our arithmetic, a density pointing to systemic default misconfiguration and duplicated template flaws rather than rare exploits.
• 95% of the Fortune 500, 52 million users, 21 billion downloads — Anaconda's existing gate inside enterprise build pipelines is the real asset this deal extends from packages to models and MCP servers.
• Compliance as enforcement: Enkrypt maps NIST AI RMF and EU AI Act requirements to automatic controls, announced two days after Article 50 transparency obligations took effect August 2, 2026.
• For developers: Inventory and allowlist every MCP server your agents can reach before evaluating any scanner, and treat tool descriptions and schemas as untrusted input in code review.
• What to watch: The Anthropic compliance integration ship date, and whether Enkrypt becomes a paid Anaconda Platform security tier rather than staying standalone.

Related Reading

• MCP 2026-07-28 stateless specification and enterprise migration guide
• Enterprise LLM security checklist: MCP, OAuth, EU AI Act
• Anthropic security guide: stop trusting AI agents
• Black Hat USA 2026 AI security and LLM integration guide
• EU AI Act Article 50 developer compliance checklist
• LLM API pricing tracker

Sources

• Anaconda press release: Anaconda Acquires Enkrypt AI to Secure the Trillion-Token Enterprise, August 4, 2026
• Anaconda blog: joint post from David DeSanto and Sahil Agarwal
• Enkrypt AI
• Enkrypt AI LLM Safety Leaderboard
• Anaconda press release: Anaconda Acquires Outerbounds
• Anaconda press release: Anaconda Acquires Kilo Code

All scan figures in this post are reported by Enkrypt AI through Anaconda communications and have not been independently verified by abhs.in.