The Model Context Protocol is spreading faster than the governance frameworks meant to contain it. New research cataloging thousands of MCP servers finds enterprise AI agents connecting to infrastructure in adversary nations and residential networks, while the protocol itself offers no mechanism to enforce the data-residency and supply-chain controls that a decade of cloud security built.
Why it matters
MCP has become the de facto wiring for agentic AI, letting models call external tools and data sources on demand. OX Security Research analyzed 15,465 published MCP servers across three public registries and narrowed the dataset to 5,095 unique hostnames for infrastructure analysis1,2. The findings expose a governance vacuum: enterprises that spent years locking down cloud posture now face AI pipelines that can silently reach servers they never vetted, in jurisdictions they would never approve.
The big picture
Of the 5,095 hostnames OX Security examined, 15.6 percent (796) resolved outside the United States, including 19 in China and 18 in Russia. About 0.45 percent of the dataset consisted of MCP servers proxied through home networks and consumer tunneling services. Another 2.3 percent of the hostnames no longer resolve at all, and six of those unresolving domains were unregistered and available for purchase at prices between $4 and $12 a year. ANALYSIS Abandoned domains at single-digit prices represent a trivial acquisition cost for an attacker who wants to impersonate a formerly legitimate MCP endpoint.
OX Security states that MCP "has no protocol-level concept of geographic region". ◆ That absence means an enterprise can enforce strict residency controls on its own cloud infrastructure yet have an AI agent route sensitive context to a server in a jurisdiction the organization would otherwise block, with no protocol-layer guardrail to prevent it.
The researchers also tested a trust-based prompt injection against Claude Code paired with Claude 3.5 Haiku. A malicious MCP server first asked for access to a harmless file, and the user approved it with an always-allow permission. The malicious server then requested a sensitive file, including .env, and obtained it with no further prompt required. Anthropic said that once always-allow is granted, "that is the documented behavior". The company also said model-level detection of malicious content "is a best-effort heuristic, not a security boundary". The same attack failed against Opus 4.6 and 4.7. ◆ The divergence between Haiku 3.5 and Opus suggests that model-tier selection has direct security consequences in agentic deployments, yet the protocol itself delegates that choice entirely to the integrator.
Between the lines
The OX Security report, titled "15,465 MCP Servers. 0 Governance," was authored by Moshe Siman Tov Bustan, Nir Zadok, Roni Bar, and Vitalii Chepurko. Its framing is blunt: the standard "leaves open which parties operate a server, where it runs, what data flows to it, and whether the deployed code matches the published source". ◆ Those four unknowns map almost exactly onto the controls enterprises already require for cloud vendors: operator identity, data residency, data-flow auditing, and code-integrity verification. MCP, as currently specified, provides none of them at the protocol layer.
A parallel thread of practitioner sentiment reinforces the concern from a different angle. As one Reddit user put it, the real issue when AI escapes a sandbox "is not with the rogue AI. The problem is with the damn sandbox"3,4. ◆ The argument that containment infrastructure, not model capability, is the weak link aligns with OX Security's finding: the protocol's lack of built-in governance is the structural gap, not any single model's behavior.
Anthropic introduced MCP in November 2024 as an open standard. ◆ In under two years the ecosystem has grown to at least 15,465 listed servers across three registries, yet the protocol still carries no native residency, identity, or integrity controls. The adoption curve has outrun the security architecture.
What's next
The OX Security research puts concrete numbers behind a risk that security teams have discussed in the abstract. With six expired MCP-server domains available for as little as $4, the window for domain-takeover attacks is open now. Enterprises adopting MCP-enabled tooling will face pressure to layer their own allowlists, hostname verification, and model-tier policies on top of a protocol that was not designed to enforce them. Anthropic's own characterization of model-level detection as "a best-effort heuristic, not a security boundary" makes the division of responsibility explicit: the protocol ships the pipe, and the integrator owns the locks.