OX Security Research reveals a governance gap in the MCP ecosystem, with servers hosted in China, Russia, and private homes
Enterprise security spent a decade building governance around the cloud: Data residency requirements, Zero Trust boundaries, Granular IAM policies and continuous supply-chain audits. Security teams know how to ask where their data lives, who operates the infrastructure it touches, and what happens when that infrastructure changes hands.
The Model Context Protocol (MCP) is routing around most of that governance.
Introduced less than 2 years ago, MCP lets AI agents, developer workstations, and automated pipelines connect to third-party servers on demand. It’s a useful standard. It’s also, in many cases, shadow AI infrastructure.
We set out to measure that gap: OX Security Research analyzed 15,465 published MCP servers across three public registries (mcp-official-registry, cline-marketplace, and github-mcp-registry), narrowing the dataset to 5,095 unique hostnames for infrastructure analysis. Here’s what we found.
- Infrastructure without borders: 15.6% of the hostnames we analyzed, 796 of 5,095, resolve outside the United States. That includes 19 in China and 18 in Russia. MCP has no protocol-level concept of geographic region. An enterprise can enforce strict residency controls on its own cloud workloads while its AI agents connect freely to servers sitting outside those same controls.
- Production traffic on consumer infrastructure: We identified MCP servers proxied through home networks and consumer tunneling services, about 0.45% of the dataset. That means production AI workflows can depend on infrastructure with no uptime guarantee, no enterprise access controls, and no real auditability, because it was never built to be enterprise infrastructure in the first place.
- Abandoned domains, live risk: 2.3% of the hostnames we analyzed no longer resolve. Six of those domains, likely still referenced in someone’s config or pipeline, were unregistered and available for $4 to $12 a year. Anyone can buy one and start impersonating the server it used to point to.
- Trust that outlives the decision that granted it: We tested a trust-based prompt injection against Claude Code paired with Haiku 3.5. A malicious MCP server first asked for access to a harmless file. The user approved it with an always-allow permission. The server then requested a sensitive file, .env among them, and got it, with no further prompt required. The same attack failed against Opus 4.6 and 4.7. Anthropic’s response, in short: once always-allow is granted, that’s the documented behavior, and model-level detection of malicious content is a best-effort heuristic, not a security boundary.
Was our decade-long, multi-billion-dollar effort around data residency a genuine, non-negotiable floor for enterprise security? Or was it merely compliance theater we are entirely prepared to abandon the moment AI promises enough convenience? We do not hold the answers, but we do know this: adoption and security aren’t the same axis, and you don’t get a secure ecosystem by assuming one follows automatically from the other – you get it because someone, somewhere, decided to care.
Read the full report covering the methodology, the complete findings, and the threat scenarios behind them.
