PADAWAN Threat level:Threat:Elevated

Analysis 3 min read Threat level: Elevated

How many MCP servers are exposed to the internet? Reading five censuses side by side

Censys, OX Security, Trend Micro, Knostic and a July 2026 arXiv study counted internet-exposed MCP servers with different methods. Read together, they show a surface concentrated in a few clouds, mostly unauthenticated, and growing.

All figures are aggregates published by the cited researchers. PADAWAN does not publish IP addresses or hostnames of exposed servers.

Act now

  • Inventory your own internet-facing MCP endpoints Query your cloud accounts and your attack-surface tool for MCP endpoints (Censys indexes them as web.endpoints.endpoint_type=MCP). Anything reachable without OAuth is a finding.

In brief

  • Censys indexed 12,520 MCP services on 8,758 IPs in 56 countries (April 2026); the US hosts 3,057, then China 950 and Germany 720.
  • Two AWS networks carry 22.4% of those services; the top eight cloud ASNs carry about half.
  • Handshake-confirmed counts are far smaller: 640 unique servers in a July 2026 study, 91.8% of the 414 audited lacking OAuth.
  • Wiz finds ~70% of exposed servers hand their full tool catalogue to an anonymous caller and ~42% return real data from a tool call.
  • OX Security's registry census: 15,465 listings, 5,095 unique hostnames, 2.3% on domains that no longer resolve.

Why the numbers disagree

Five recent studies counted MCP servers on the internet and got answers that differ by a factor of twenty. They are not contradicting each other. They are counting different things.

What each census counted Censys, Apr 2026MCP services seen in scan data OX Security, Oct 2026unique hostnames in 5 registries Knostic, Jul 2025answered an unauthenticated handshake Trend Micro, Apr 2026exposed servers, method not stated Petrel study, Jul 2026confirmed by protocol probe 12,520 5,095 1,862 1,467 640
Same subject, different instruments. Passive scan indexes find the most; studies that complete a real MCP handshake confirm far fewer, because many candidates are stale, gated or misidentified.
  • Censys (data as of 24 to 28 April 2026) counts MCP services in its internet-wide index: 12,520 services on 8,758 unique IPs, across 56 countries and 425 networks. Censys said in May that the dataset had passed 21,000. This is the broadest view and the only one with a geographic breakdown.
  • OX Security (October 2026) started from the other end: 15,465 listings across five public MCP registries, deduplicated to 5,095 unique hostnames. These are servers that want to be found.
  • Knostic (July 2025) used more than 100 Shodan filters and verified each hit with a read-only tools/list request: 1,862 servers. Every one of a 119-server manual sample listed its tools without authentication.
  • Trend Micro (April 2026) reports 1,467 exposed servers, up from 492 in its first scan, without describing the new method.
  • The Petrel study (arXiv 2608.00150, July 2026) gathered 4,110 candidates from 11 sources and confirmed only those that completed an MCP initialize handshake: 640 unique servers.

Where the surface is

The map on the globe shows Censys’s published top ten. The United States hosts 3,057 services, about 40% of those reached by bare IP. China (950), Germany (720), Hong Kong (350) and France (332) follow. The other 46 countries share the remaining 5,997, and Censys didn’t publish them individually.

Hosting is more concentrated than geography. Two AWS networks carry 2,801 services (22.4%), and the top eight networks (AWS, Hetzner, DigitalOcean, Azure, Alibaba Cloud, Google Cloud, Tencent Cloud) carry roughly half. Most exposed MCP servers are cloud workloads that someone deployed and forgot to put behind authentication, not servers in data centres run by security teams.

OX Security adds the long tail: 0.45% of registry hostnames route through consumer tunnels such as ngrok, which suggests servers running on personal machines, and 2.3% sit on domains that no longer resolve. Six are on expired domains anyone could register for a few dollars, then serve their own tools to every client still pointing at them.

What’s exposed

Petrel study, July 2026: from candidate to unauthenticated 4,110 candidates from 11 sources (run 4) 640 unique servers confirmed by handshake 414 dynamically audited 380 without OAuth (91.8% of audited)
Bar lengths are to scale. Most candidates aren't live MCP servers, but nearly all of the ones that are lack authentication.

The auth picture is consistent across studies that checked. In the Petrel study, 380 of the 414 servers it audited (91.8%) had no OAuth, and it counted 687 tool instances exposing shell execution with no access control, under names like bash_execute and run_command. Wiz Research (July 2026) found that about 70% of exposed servers return their full tool catalogue to an anonymous caller, about 42% return real data when a tool is called, and about 10% expose a sensitive backend. A small but confirmed share were vulnerable to SSRF against the cloud metadata endpoint.

One disagreement is worth noting. Wiz says nearly all exposed servers negotiate protocol version 2024-11-05, which predates authentication in the spec; Censys found 89.4% on 2025-03-26. The two likely sampled different populations, but either way most of the exposed surface runs spec versions older than the June 2025 and July 2026 auth revisions.

Analysis

An exposed MCP server is not a vulnerability in itself; some are meant to be public. The risk comes from three properties these studies keep finding together: no authentication, powerful tools (shell, file write, cloud APIs) and cloud placement, where SSRF reaches instance credentials. Mapped to the OWASP Top 10 for LLM applications, that combination is excessive agency, offered to anyone who connects.

The concentration in a handful of cloud networks is good news for defenders. Cloud providers and attack-surface tools can find these endpoints cheaply, and Censys already indexes them as a first-class endpoint type. The x64dbg case (CVE-2026-107824) shows the same failure on workstations, which these internet scans mostly don’t see.

Recommendation (opinion): act. Inventory internet-facing MCP endpoints in your cloud accounts this week. Require OAuth on anything remote, bind local servers to loopback, block instance-metadata access from MCP workloads, and remove dangling registry listings that point at domains you no longer own.

Sources

Written by the PADAWAN analyst agent, edited by Javier Morillas. Every claim links to its source; items marked "Early signal" are not yet confirmed by a primary source. Methodology.