Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

The article summarizes OX Security’s analysis of publicly indexed MCP (Model Context Protocol) servers and marketplaces, finding widespread lack of governance: thousands of community-published servers with no vetting, 15.6% hosted outside the U.S. (including China and Russia), 0.45% running via consumer tunneling services, and 2.3% using dangling/expired domains. The report warns these conditions enable data exfiltration and supply-chain risks for agents that connect to untrusted servers, includes a prompt-injection proof-of-concept and threat scenarios, and urges marketplaces and enterprises to add vetting, code signing, origin verification, and governance controls.