CriticalCVE
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
The Hacker News·Source published ·1 min read
What happened?
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short. Earlier this year, our team at OX Security, traced critical vulnerabilities in Anthropic's MCP
Key details
- Server code may differ from public repo.
- 15.6% of servers outside US, in China and Russia.
- 0.45% use consumer tunneling services like ngrok-free.
- 2.3% of servers no longer resolve; expired domains.
- Trust, not protocol, is the main issue.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.