Artificial Intelligence
OX Security finds gaps in 15,465 MCP servers
OX Security said it analysed 15,465 publicly indexed MCP servers across five registries and found weak review, unresolved domains and connections that could route data outside approved jurisdictions.
- OX Security said it analysed 15,465 publicly indexed MCP servers across five registries and reduced them to 5,095 unique hostnames.
- It said 15.6% of hostnames resolved to infrastructure outside the United States, including 19 in China and 18 in Russia.
- It said 0.45% of servers routed traffic through consumer tunnelling services, mainly ngrok-free, and 2.3% no longer resolved.
- The article said six servers sat on expired domains that could be re-registered for $4 to $12 a year.
- The article said the report included methodology and a prompt-injection proof of concept, and argued for vetting, code signing and origin verification.
Earlier in the year, OX Security said it had traced critical vulnerabilities in Anthropic’s MCP source code. In this article, it said it then examined community-published servers from popular MCP registries.
The company said it looked at 15,465 publicly indexed servers across five registries and reduced them to 5,095 unique hostnames. It said 15.6% of hostnames resolved outside the United States, including 19 in China and 18 in Russia.
OX Security said 0.45% of the servers sent traffic through consumer tunnelling services, mainly ngrok-free. It said 2.3% no longer resolved, and that six used expired domains that could be registered for $4 to $12 a year.
The article said remote MCP servers could run backend code that did not match what their public repositories showed, so repository review would not reveal the runtime behaviour. It said the report contained its methodology and a prompt-injection demonstration, and it called for vetting, code signing and origin verification before enterprise use.
Named in this story
Companies
- Anthropic
- the company whose MCP source code OX Security had previously reviewed
- OX Security
- the security firm that carried out the analysis and authored the piece
- the company that previously ran Bouncer
Organisations
- RSAC
- one of the events where the authors said they had presented a talk
- OWASP
- one of the events where the authors said they had presented a talk
Products and systems
- Model Context Protocol
- the protocol the article examined
- Bouncer
- Google’s automated scanner for Android apps
- ngrok-free
- the consumer tunnelling service named in the routing analysis
Places
- United States
- the jurisdiction used as the main comparison point for server locations
- China
- one of the countries where some hostnames resolved
- Russia
- one of the countries where some hostnames resolved
How the source tells it
The source was overtly promotional and warning-driven, mixing security alarm with a lead-generation pitch for a report and webinar.
- alarm predator-prey imagery and absolute claims about missing safeguards
- urgency time-sensitive warnings and a dated webinar registration push
- vendor boosterism the findings were wrapped around a downloadable report and staff promotion