Inside 15,465 Public MCP Servers: What the Data Shows About Governance Gaps
More than 15,000 public Model Context Protocol servers are now reachable across community marketplaces, and the data on where those servers live, who runs them, and how they are reviewed shows an ecosystem without guardrails. The analysis of 15,465 publicly indexed servers, deduplicated to 5,095 unique hostnames, gives a clear picture of the supply chain that enterprise AI agents are plugging into today.
What the protocol set out to do, and where the ecosystem fell short
Model Context Protocol launched in 2024 with a simple promise: one standard for connecting AI models, agents, and IDEs to tools and data, working the way USB-C works for hardware. On that core, the protocol delivered. Thousands of developers built servers, and enterprises wired them into agent workflows.
The ecosystem around it did not keep up. Earlier research traced critical vulnerabilities in Anthropic’s MCP source code, a package downloaded more than 150 million times. The new analysis shifts the focus from code quality to what users actually install: community-published servers listed across the most popular MCP marketplaces.
How was the public MCP server ecosystem measured?
The research team pulled 15,465 publicly indexed MCP servers across five MCP registries and deduplicated them to 5,095 unique hostnames. From those hostnames, three findings stand out about how the infrastructure is actually run.
Where are public MCP servers hosted?
15.6% of the unique hostnames resolve to infrastructure outside the United States. That group includes 19 hostnames in China and 18 in Russia. When an agent connects to one of these servers, it may send data to jurisdictions the security team never approved, bypassing the data residency, Zero Trust, granular IAM, and supply chain audit work enterprises built over the last decade to make public cloud safe.
How many run on personal machines?
0.45% of servers route traffic through consumer tunneling services, mainly ngrok-free. These publicly listed servers run from personal machines and, in many cases, home networks. The report notes that an operator could launch a server on a clean US IP address and later route traffic somewhere else, so geography at install time is not a stable signal.
How many MCP server domains have gone dark?
2.3% of the hostnames no longer resolve. Six of those sit on expired domains that anyone can register for $4 to $12 a year. A new owner of an expired domain would inherit an established server identity, along with the requests from any agent still configured to call it.
Is there any review of MCP servers before they are published?
No. Anyone can write a server, push it, and publish it. There is no equivalent of the automated scanning layer that Google introduced for Android apps in 2012, which, while imperfect, at least existed. MCP marketplaces have no bouncer at the door, and the gap is not closed by code review. Remote MCP servers can run backend code that differs entirely from what their public repository shows, so a code review tells you what the developer published, not what the server actually runs.
What is the practical risk for enterprises?
The protocol is not the problem. The trust handed to it is. MCP connections often sit outside the strict governance enterprises built for public cloud: data residency rules, Zero Trust boundaries, granular IAM, and supply chain audits. An agent that calls a community-published server can be sending prompts, tool inputs, and retrieved data to a host the security team has never seen, in a country no one approved, through code the public repo does not reflect.
Until MCP marketplaces add vetting, code signing, and origin verification, the enterprise has to do that work itself. For teams adopting agent workflows, that means treating every community MCP server the way they would treat a third-party software vendor without a security review: inspect the publisher, pin the version, log every call, and watch where the traffic actually goes.
FAQ
How many public MCP servers were analyzed?
15,465 publicly indexed MCP servers across five MCP registries, deduplicated to 5,095 unique hostnames.
Do MCP marketplaces review servers before listing them?
No. The analysis found no marketplace vetting, no review, and no equivalent of an automated pre-publish scanner. Anyone can write a server, push it, and publish it.
Where are public MCP servers hosted?
15.6% of unique hostnames resolve to infrastructure outside the United States, including 19 in China and 18 in Russia. 0.45% route traffic through consumer tunneling services from personal machines, and 2.3% of hostnames no longer resolve, with six sitting on expired domains available to register for $4 to $12 a year.
This article summarizes reporting from thehackernews.com.