MCP servers reveal enterprise AI infrastructure risks

Enterprise adoption of Model Context Protocol (MCP) is creating a new infrastructure security gap as AI agents connect to servers outside conventional cloud governance. A study covering 15,465 published MCP servers found weak controls around hosting location, domain ownership, and persistent permissions, raising concerns about data residency and supply chain oversight for organizations.

What the research uncovered

The research, commissioned by OX Security, analyzed publicly accessible MCP servers used by AI agents to connect with external systems. Nearly all servers examined lacked enforceable policies on where they could be hosted, allowing deployment on foreign networks, consumer-grade connections, or even abandoned domains. Persistent permissions granted to AI agents further complicated oversight, as access rights remained active even after initial use.

Anthropic introduced MCP in late 2024 as a standardized method for AI agents to interact with external data sources and tools. While the protocol has gained traction in developer tooling and enterprise automation, its rapid adoption has outpaced governance frameworks, leaving organizations exposed to unintended infrastructure risks.

Why governance gaps matter

The findings highlight operational challenges for enterprises scaling AI deployments. Without controls on hosting locations, organizations risk violating data residency requirements or exposing sensitive workflows to untrusted networks. Abandoned domains hosting MCP servers could also become vectors for supply chain attacks, as expired ownership might allow malicious actors to hijack connections.

Persistent permissions add another layer of complexity. AI agents retaining access to external systems indefinitely create audit and compliance challenges, particularly in regulated industries where access logs and revocation processes are mandatory. The lack of standardized governance tools for MCP means organizations must manually track and manage these connections, increasing operational overhead.

What operators can do

Enterprises using MCP should inventory all published servers and enforce hosting policies that align with data residency and security requirements. Automated discovery tools, like those offered by OX Security, can help identify rogue or misconfigured servers. Organizations should also implement time-bound permissions for AI agents, ensuring access is revoked after use unless explicitly renewed.