Summary
Connecting smart software agents to data and services over the internet is becoming more common using something called the Model Context Protocol (MCP). The paper studies how the remote servers running these MCP services are mostly concentrated among a few providers and use strong platform-level security that makes it hard to check for security problems automatically. The researchers found that many servers rely on common hosting platforms that enforce strict authentication, which improves security but limits how easily they can be tested for vulnerabilities. This leads to a tradeoff between making servers secure and being able to observe or scan them for hidden risks.
What this means in practice
- •For network security teams: Assess risk posed by server concentration and platform-based authentication in MCP deployments to improve security strategies.
- •For cloud platform operators: Design authentication mechanisms that balance strong security with enabling vulnerability scanning of hosted MCP servers.
Abstract
The Model Context Protocol (MCP) has emerged as the dominant interface for connecting autonomous agents to external data sources and execution environments. The ecosystem's transition from local process execution to remote Streamable HTTP deployments introduces unmeasured architectural and security constraints at scale. This paper presents a three-tier observability framework comprising catalog metadata (O_0), passive compliance signals (O_1), and live vulnerability analysis (O_2), applied to empirically characterize the public MCP server ecosystem. Evaluation of a stratified sample of 179 remote endpoints across two primary public registries reveals significant infrastructural consolidation. The Herfindahl-Hirschman Index (HHI) computed over the Autonomous System Number (ASN) distribution yields a value of 0.736, well above the 0.25 threshold for a highly concentrated market. Analysis further indicates that server authentication is strongly correlated with hosting platform choice rather than individual operator configuration, with 95\% of commercial PaaS-hosted servers enforcing gateway-level OAuth 2.1 with PKCE. The empirical results identify a Security-Observability Tradeoff observed in the current ecosystem: the platform-level authentication mechanisms that secure the majority of servers simultaneously limit automated vulnerability scanning capabilities, constraining the ability of AI gateway operators to assess tool-poisoning vectors without prior credential provisioning.