MCP Server Security: 15,465 Public Servers, Zero Vetting

A census of the MCP ecosystem

The Model Context Protocol (MCP) has become a standard way to connect AI assistants and coding agents to outside tools and data. A new survey suggests its infrastructure is growing faster than anyone is checking it. Researchers at OX indexed 15,465 publicly listed MCP servers and found no marketplace vetting across that population 1. The servers they catalogued included some tied to expired domains and others hosted through consumer tunneling services rather than stable, accountable infrastructure 1.

Each of those details matters for a different reason. An expired domain is a known supply-chain hazard. If a server listing still points to a domain whose registration has lapsed, anyone who re-registers that domain could start serving responses to agents that still trust the old entry. Consumer tunnels expose a service running on someone's own machine to the public internet. They suggest that some listed servers are hobby projects or temporary setups, with no clear operator, uptime guarantee, or security posture behind them.

Marketplaces without gatekeepers

The timing is significant. MCP servers are moving into marketplaces, the directories that let developers find and install integrations in a few clicks, even as security gaps keep accumulating 2. A marketplace implies some curation, much as app stores have trained users to assume that a listing has passed at least basic review. OX's finding of no vetting across more than fifteen thousand entries undercuts that assumption 1.

This is a familiar pattern from earlier software ecosystems. Package registries for languages such as JavaScript and Python went through years of typosquatting, abandoned-package takeovers and malicious uploads before review and provenance tooling caught up. MCP inherits those risks and adds a new one: the consumer of a server is often an AI agent acting with delegated authority, not a human reading the code. An agent that pulls context or calls tools from an untrusted server may be steered in ways a user never sees.

Big platforms are leaning in anyway

Adoption is not slowing down. WebKit has introduced a Safari MCP server aimed at web developers 2. Reporting described it as a way for coding agents to interact with the browser and to inspect and debug websites directly 2. Under that design, AI clients such as Claude Desktop can connect to Safari and request browsing context, with the user's consent 2. Site owners get controls of their own. They can govern what their pages share through HTTP response headers and meta tags, using directives such as model-context-allow and model-context-block 2. One account characterizes MCP itself as co-developed by Apple and Anthropic 2. That attribution is worth treating cautiously, because MCP is more commonly described as an Anthropic-originated open standard.

The Safari approach is a useful contrast to the open-registry chaos OX describes. It comes from a known vendor, requires explicit user consent, and gives content owners a way to opt out. Those are the kinds of trust signals that many of the 15,465 public servers appear to lack 12.

Where the two pictures meet

The two strands of reporting do not contradict each other. They describe two layers of the same ecosystem. At the top, major platform vendors are shipping first-party MCP servers with permission models and documented controls 2. In the long tail, thousands of unvetted servers sit behind lapsed domains and personal tunnels, listed in directories that do not check them 1. Developers and their agents can reach both through the same protocol, often through the same discovery channels.

One caveat applies. The available summary of OX's research does not say how many of the servers it found are actively malicious, as opposed to simply neglected or poorly run. Unvetted does not mean hostile. But in supply-chain security, neglected infrastructure is often where attackers get in. An abandoned domain or an unmaintained endpoint costs little to hijack and is rarely watched.

The takeaway

In our reading, MCP has reached the stage where its growth is outpacing its governance. The protocol is useful enough that companies like Apple are building on it 2. Its public directory layer, meanwhile, works on trust it has not earned 1.

For teams deploying agents, the practical lesson is to treat third-party MCP servers like any untrusted dependency. That means:

• pinning known operators;
• checking domain ownership and hosting;
• preferring first-party servers with clear consent models;
• limiting what tools an agent may call.

For marketplace operators, the pressure is building to add the basic checks that other registries learned to adopt the hard way: domain validation, operator identity and some form of review. Until that happens, much of the MCP ecosystem will remain unmapped territory for users, with few signals about which servers they can trust.