Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Public MCP server listings are not proof that a service is safe, malicious, or even still running. In an October 2026 snapshot, OX Security analyzed 15,465 published server listings, then examined infrastructure associated with 5,095 unique hostnames. Its findings raise practical questions about hosting, abandoned domains, permissions, and prompt injection—but they do not establish where a particular user’s data went or how common these risks are across all MCP deployments.
What OX Security measured—and what the numbers count
OX Security’s research page and its September 24 article describe an analysis of public MCP server listings and associated infrastructure. The published-server count and the hostname count are different units: registry entries are not necessarily unique operators, active services, or verified deployments.
As an Amazon Associate I earn from qualifying purchases.
| Reported observation | What it refers to | What it does—and does not—show |
|---|---|---|
| 15,465 published MCP servers | Listings OX says it analyzed | A count of published listings, not confirmed live or distinct deployments. |
| 5,095 unique hostnames | The set narrowed to for infrastructure analysis | The denominator for the hostname findings below, not the total number of server listings. |
| 796 hostnames (15.6%) resolved outside the United States | OX’s analysis of the 5,095 hostnames; it also lists 19 in China and 18 in Russia | A resolution/location observation, not proof that a particular user’s data was stored, processed, or transmitted in those countries. |
| 0.45% associated with home networks or consumer tunneling tools | Analyzed hostnames, as reported by OX | An infrastructure association, not a confirmed compromise rate or proof of malicious activity. |
| 2.3% no longer resolved; six domains were unregistered | Analyzed hostnames, as reported by OX | A potential exposure if a client continues to contact a name after someone else can register it; it does not show that takeover occurred. |
The registry scope is not described consistently across the available accounts. OX’s September article names three public registries—mcp-official-registry, cline-marketplace, and github-mcp-registry—while later contributed coverage describes five. The accessible OX research page does not provide the complete collection and validation protocol, so the discrepancy cannot be resolved here. Treat the findings as OX’s snapshot of the public listings and hostnames it analyzed, not as an independently verified census or a prevalence estimate for all MCP servers.
Can a public MCP server send data to another country?
It can depend on the server, its operator, the client’s network route, and what information the client sends. OX’s finding that some hostnames resolved outside the United States is relevant to jurisdiction review, but DNS or infrastructure observations alone do not reveal where a specific request was routed or where user data was ultimately processed or stored. Hosting and DNS can also change after a scan.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
For an organization with residency or sovereignty requirements, a registry listing is not enough to establish compliance. Verify the actual endpoint, its operator and hosting arrangements, the data the integration can access, and whether the service’s deployment or destination changes over time.
What happens if an MCP server’s domain expires?
If a hostname stops resolving and later becomes available for registration, a client that keeps calling it could potentially connect to a new operator’s service. That is a conditional takeover exposure: it depends on the domain becoming available and a client continuing to trust and use the name. OX reported unregistered domains among names that no longer resolved, but did not report that those names had been taken over.
Do not treat an old repository or listing as proof that its endpoint still belongs to the original publisher. Maintain an owner for each approved endpoint, monitor domain and DNS changes, and remove or reapprove a connection when its service identity changes.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Can prompt injection get an MCP server access to files?
OX describes a bounded test in Claude Code using Haiku 3.5. In the reported scenario, a malicious MCP server first asked to access a harmless file. After the user selected “Always-Allow,” the server used prompt injection to obtain access to a sensitive file, including .env, without another confirmation. OX says the same attack did not succeed in its tests with Opus 4.6 or 4.7.
This is a result for that reported setup and permission choice, not a general ranking of models or proof that any MCP server can read files. OX also paraphrases Anthropic’s explanation that “Always-Allow” behaved as documented and that model-level detection of malicious content is a best-effort heuristic, not a security boundary. A user-granted persistent permission can therefore matter as much as the model’s response to suspicious instructions.
Review each server’s requested tools and file access before granting permission. Prefer the narrowest access that supports the task, avoid persistent approval for capabilities you do not fully trust, and revoke access when it is no longer needed.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What MCP authorization changes do—and do not—guarantee
The MCP specification update dated July 28, 2026 describes authorization changes including issuer validation and issuer-bound client credentials. It also says Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThese are authorization mechanisms; they do not establish that a server’s operator is trustworthy, that its domain is stable, that it runs reviewed code, or that it is hosted in an approved jurisdiction. Authentication and authorization help govern access, but they are not marketplace scanning, runtime code attestation, domain-ownership monitoring, or geographic enforcement.
How organizations can review third-party MCP servers
The following controls are defensive recommendations derived from the risks described above; OX’s findings do not show that these controls were tested.
- Inventory every connection. Record the MCP server, endpoint and domain, operator or internal owner, business purpose, approving team, and the client or agent that uses it.
- Allowlist approved endpoints. Require review before adding a server, and define who can approve a new destination or a change to an existing one.
- Review access and data flow. Check which tools, files, credentials, and business data the server can reach. Apply least privilege and avoid granting access that is not needed for the task.
- Validate the deployed service. Review the running endpoint and its operator, not only a public listing or source repository. Where location matters, confirm the hosting and processing arrangements rather than inferring them from a hostname lookup.
- Monitor changes and constrain network access. Watch for DNS, domain-ownership, endpoint, or deployment changes. Use egress controls so an agent can reach only approved destinations, and make it possible to disable a connection quickly.
- Re-review changed or abandoned services. Renew approval when the server’s identity, code, operator, permissions, or deployment changes; remove connections that are no longer maintained or needed.
As OX Security research team lead Moshe Siman Tov Bustan put it in contributed coverage, “Code review tells you what the developer published, not what the server runs.” A repository review can inform a decision, but the deployed service and the permissions granted to it also need governance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
