OX counted 15,465 public MCP servers with no vetting. Here's what I see across 45,143.
OX Security is right that marketplace listings carry no trust signal. My census of 45,143 servers says the bigger bucket is unknown, not proven bad. Check before you connect. Then still read the config.
OX Security Research analysed 15,465 published MCP servers across three public registries and found no marketplace review. I run MCP Census, which tracks 45,143 servers. I agree with the headline. Most listings carry no trust signal at all. My numbers say the picture is less "15k unvetted" and more "a lot is simply unknown": 4,138 servers show issues, 17,455 look healthy by public evidence, and the rest I cannot call either way yet. Before you connect one, check it. Then still read its config yourself.
The numbers side by side
| Measure | OX Security (24 Sep 2026) | MCP Census (captured 14 Oct 2026, 17:45 UTC) |
|---|---|---|
| Servers counted | 15,465 publicly listed | 45,143 tracked |
| Unique hostnames | 5,095 | Not a Census metric |
| Marketplace vetting | None found | Not measured. Census is not a marketplace |
| Servers flagged with issues | Not stated | 4,138 |
| Healthy by public evidence | Not stated | 17,455 |
| Remote (hosted endpoint) | Not stated | 28,006 |
| Linked to a GitHub repo | Not stated | 13,808 |
| Hostnames outside the US | 15.6% (796 of 5,095), incl. 19 China / 18 Russia | Not reported as a separate count |
| Consumer tunnels / home networks | About 0.45% | Not reported as a separate count |
| Hostnames that no longer resolve | 2.3%; six on expired domains ($4–$12/yr) | Not reported as a separate count |
| Actively malicious | Not claimed | Not measured. Census is not a malware scanner |
Coverage breakdown from the live transparency report (generated 15 Oct 2026, 22:06 UTC, same 45,143-server snapshot): 16,904 DNS-verified, 27,725 GitHub-verified, 514 unverified. Of hosted endpoints, 10,250 were observed live, 597 observed down, and 17,284 not yet checked. Source: Coverage.
The two totals measure different things. OX counted marketplace listings (they name mcp-official-registry, cline-marketplace, and github-mcp-registry). Census harvests the official registry plus Glama, Smithery and the awesome lists, then dedupes. Do not read 45,143 vs 15,465 as one of us being wrong.
Primary source: OX Security blog, 24 Sep 2026. Full report landing: 15,465 MCP Servers. 0 Governance.. A same-author write-up also ran on The Hacker News, 6 Oct 2026.
Where I agree with OX
Listings with no review are the norm. A directory entry tells you a server exists. It does not tell you who runs it, whether the repo is still alive, or whether the domain still belongs to the same person. The expired-domain point is the one I would worry about most: if a listing points at a lapsed domain, whoever re-registers it gets to answer your agent.
Where my numbers add something
The biggest category in my data is not "bad". It is "unknown". 17,284 hosted endpoints have not been checked yet, and thousands of servers have no repo I can link. I would rather show that gap than round it into a scary headline. Unknown should make you slow down, not panic.
What Census does and does not do
Census is a first gate, not a security audit. For a named server it checks public identity, whether the repo and package are still maintained, live endpoint status and known vulnerabilities in OSV, then returns PASS, REVIEW or BLOCK under a versioned policy. Every verdict links to its evidence.
It does not read code, check permissions or scopes, or test how a server binds and authenticates. The argocd-mcp bug (CVE-2026-82456, CVSS 10.0) is a good example of what it would miss. Version 0.8.0 listened on every interface, skipped auth and ran callers' requests with the operator's Argo CD token. Census does not check bind address or Origin handling, and that server was not in Census at all. A PASS would not have saved you there. Reading the transport config would have.
My rule: stop on BLOCK, ask a human on REVIEW, and treat PASS as "worth reviewing", not "safe".
What I would do before connecting a server
- Look it up by exact name and check who published it (official vendor vs lookalike).
- Check the repo and package are still live and recently maintained.
- Check the domain on the listing still belongs to that publisher.
- Avoid servers served from personal tunnels for anything with real credentials.
- Read how it binds and authenticates. Limit the tools your agent may call.
Free lookup: mcpcensus.com/lookup. Agents: MCP endpoint api.mcpcensus.com/mcp (census_search, then census_preflight).
FAQ
How many public MCP servers are there? OX counted 15,465 publicly listed servers across three registries. MCP Census tracks 45,143 across the official registry, Glama, Smithery and the awesome lists (snapshot 14 Oct 2026). The counts differ because the sources and dedup rules differ.
Are MCP marketplaces vetted? OX found no marketplace vetting across its population. I have not seen evidence otherwise. Treat a listing as a pointer, not an endorsement.
How many MCP servers have problems? Census flags 4,138 with issues and rates 17,455 healthy by public evidence. Thousands more are unchecked or unlinked, so the real number is unknown.
Does a PASS from MCP Census mean a server is safe? No. PASS means public identity, maintenance and known-vulnerability checks came back clean. It does not cover code, permissions or runtime isolation.
Would Census have caught the argocd-mcp CVE? No. That bug was about binding and auth, which Census does not test, and the server was not in the census.