Security teams now have a measured view of public MCP marketplaces: 15,465 publicly indexed servers across five registries were deduplicated to 5,095 unique hostnames, and the scan found no mandatory review, foreign-hosted endpoints, traffic running through consumer tunnels on personal machines, and expired domains that anyone can re-register for a few dollars.<\/p>\n
Model Context Protocol was introduced in 2024 as a single standard for connecting AI models, agents, and IDEs to tools and data. The protocol delivered on that promise. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around the protocol fell short, and that gap is where the risk now lives.<\/p>\n
Google ran Bouncer starting in 2012, an automated scanner that checked Android apps for malware before users could install them. It was imperfect, and researchers did slip malware past it. Crucially, it existed as a checkpoint. Public MCP marketplaces have no equivalent. Anyone can write a server, push it, and publish it. The comparison matters because code review of a public repository only confirms what the developer published. A remote MCP server can run backend code that differs entirely from what the repository shows.<\/p>\n
Over the past decade enterprises built strict guardrails for public cloud adoption: data residency rules, Zero Trust boundaries, granular IAM, and supply chain audits. MCP connections often sit outside all of it. The scan measured the gap and the numbers show how exposed that posture is.<\/p>\n
15.6% of unique hostnames resolve to infrastructure outside the United States. That includes 19 hostnames in China and 18 in Russia. An agent connected to these servers may send enterprise data to jurisdictions the security team never approved.<\/p>\n
0.45% of servers route traffic through consumer tunneling services, with the report calling out ngrok-free style endpoints. These publicly listed servers appear to run from personal machines and, likely, home networks, well outside corporate network controls.<\/p>\n
2.3% of hostnames no longer resolve. Six sit on expired domains that anyone can register for $4 to $12 a year. A new owner would inherit the established server identity, along with any requests from agents still configured to call it. The operator can also change hosting location over time, launching on a clean US IP address and later redirecting traffic elsewhere.<\/p>\n
The protocol itself is not the problem. The trust handed to it is. Until marketplaces add vetting, code signing, and origin verification, the enterprise has to do that work itself. A report titled “15,465 MCP Servers, 0 Governance” covered the methodology, a prompt-injection proof of concept, and the threat scenarios behind each finding.<\/p>\n
Treat community-published MCP servers the same way you treat unverified open-source dependencies. Pin exact server versions and hashes, audit the code you actually run rather than only what the repository links, log every outbound call so a foreign endpoint or a sudden IP change is visible, and require allowlists for the data an agent can hand to a third-party tool. Treat the marketplace as untrusted by default and put your own gate at the boundary, since the registries publish without checking.<\/p>\n
The scan covered 15,465 publicly indexed MCP servers across 5 registries, deduplicated to 5,095 unique hostnames. There was no mandatory vetting, 15.6% of hostnames resolved outside the US, 0.45% routed through consumer tunneling services running from personal machines, and 2.3% no longer resolved because their domains had lapsed.<\/p>\n
An agent connected to these servers may send enterprise data to jurisdictions the security team never approved. The operator can also relaunch on a clean US IP and later route traffic elsewhere.<\/p>\n
Model Context Protocol is positioned as a universal connector for AI models, agents, and IDEs. The protocol works as intended. The risk sits in the ecosystem around it: marketplaces publish servers without review, code review of the public repository does not match what the remote server actually runs, and domains can be re-registered cheaply by anyone after expiry.<\/p>\n