MCP servers expose widening enterprise governance gaps

Model Context Protocol (MCP) servers have revealed significant weaknesses in enterprise security governance as artificial intelligence agents connect to infrastructure beyond established corporate controls, according to new research examining over 15,000 servers. OX Security analyzed 15,465 MCP servers and identified 5,095 unique hostnames, discovering that 15.6% of the hostnames resolved to infrastructure outside the United States.

Notable locations included China and Russia. OX Security found that the MCP protocol, originally introduced by Anthropic, lacks a mechanism to enforce where connected tools operate or where information is processed, weakening security controls. Additionally, 0.45% of the analyzed hostnames were associated with consumer internet service provider networks or personal tunnelling tools, potentially placing AI workflows on personal devices outside centralised monitoring.

Furthermore, 2.3% of the hostnames no longer resolved, including six unregistered domains that could be purchased for as little as $4 per year, posing risks of inherited trust from compromised MCP clients. The research highlights the challenges enterprises face in authenticating, authorizing, and monitoring agentic AI connections, with limited visibility into MCP server connections and insufficient fine-grained per-tool authorisation in base SDKs.

A malicious server tested by OX Security demonstrated how prompt injection could lead to unauthorized access to sensitive files, emphasizing the need for continuous verification and secure-by-default architecture in MCP governance.