al-ice.ai

15,465 MCP Servers, Zero Governance — and Six Dead Domains Anyone Could Buy

AI Security Research by al-ice.ai Editorial

Enterprise security spent a decade building governance around the cloud — data residency, zero-trust boundaries, granular IAM, supply-chain audits. Then the Model Context Protocol gave every AI agent, developer workstation, and automated pipeline the ability to connect to third-party servers on demand, and most of that governance got routed around. On September 24, OX Security Research (Moshe Siman Tov Bustan, Nir Zadok, Roni Bar, and Vitalii Chepurko) published the measurement: 15,465 MCP servers analyzed across three public registries, narrowed to 5,095 unique hostnames for infrastructure analysis, in a report titled “15,465 MCP Servers, 0 Governance.”

The numbers read like a pre-incident report for an incident that is already happening quietly. And the most quotable experiment in the paper is not about infrastructure at all — it is about what “always allow” actually means once a user clicks it.

The census: borders, basements, and corpses

Infrastructure without borders. 796 of the 5,095 hostnames — 15.6% — resolve outside the United States, including 19 in China and 18 in Russia. MCP has no protocol-level concept of geographic region, so an enterprise enforcing strict residency on its own cloud workloads can simultaneously have its agents connecting freely to servers outside those controls. Residency policy ends where the tool call begins.

Production traffic on consumer infrastructure. About 0.45% of the dataset is proxied through home networks and consumer tunneling services — production AI workflows depending on infrastructure with no uptime guarantee, no enterprise access controls, and no real auditability, because it was never built to be enterprise infrastructure.

Abandoned domains, live risk. 2.3% of the hostnames no longer resolve at all — and six of those domains were unregistered and purchasable for $4 to $12 a year. Anyone can buy one and start impersonating the server it used to point to, inheriting whatever configs and pipelines still reference it. Trust that outlives the decision that granted it, available at domain-registrar prices. Readers of yesterday’s placeholder-domain ClickFix story will recognize the shape: a string in a config file that resolves, one day, to someone else.

Always-allow means always

The experiment: a malicious MCP server first asked for access to a harmless file. The user approved it with an always-allow permission. The server then requested a sensitive file — .env among them — and got it, with no further prompt. The pairing was Claude Code with Haiku 3.5. OX repeated the attack against Opus 4.6 and 4.7, where the injected prompt was detected and the tool call blocked — so the behavior is model- and configuration-dependent, not a universal bypass.

Anthropic’s response, as reported by OX, is the part defenders should internalize: once always-allow is granted, that is the documented behavior, and model-level detection of malicious content is a best-effort heuristic, not a security boundary. Read that twice. The permission model treats the first approval as a durable grant; the safety net is a heuristic that varies by model. A control whose enforcement depends on which model happens to be answering is not a control — it is a hope with a version number. It is the same conclusion the tool-allowlisting research reached from the defensive side: the constraint has to live outside the model, or it is not a constraint.

What to do

  • Inventory every MCP server your agents can reach — registry name, hostname, operator, jurisdiction. If you cannot produce this list, you are running shadow AI infrastructure by definition.
  • Serve agents from a curated catalog, not public registries. Verified publishers, pinned versions, and an explicit allowlist for tool connections — the same discipline registries were supposed to provide and mostly do not.
  • Monitor the DNS under your agent configs. Alert on referenced hostnames that stop resolving or change ownership; treat re-registration of a dead dependency domain as a compromise of everything pointing at it.
  • Ban always-allow for sensitive scopes. File-system, credential-store, and network-egress tools should require per-call approval or policy-gated execution — never a durable grant born from one harmless-looking request.
  • Enforce residency at the egress, not the workload. If agents can call arbitrary MCP endpoints, cloud-region policy is decorative. Proxy or gateway agent tool traffic and apply the same geo and audit controls you apply to everything else.

OX’s closing question is pointed enough to repeat: was the decade-long effort around data residency a genuine floor for enterprise security, or compliance theater we are prepared to abandon the moment AI promises enough convenience? Adoption and security are not the same axis. Somebody has to decide to care — per tool call, per hostname, per permission grant.

Sources: