PaperlayerView exact revision on arXiv

Source-linked AI summary

Characterizing Network Centralization and Observability in the Remote MCP Ecosystem

Muhammad Abdullah Sohail

arXiv:2609.19100v1cs.CR

TL;DR

Remote MCP deployments raise questions about server-side security visibility and infrastructure at scale. This study applies a three-tier observability framework to 179 endpoints from two public registries. It finds high hosting concentration and a platform-authentication association with reduced automated scanning visibility.

  • Problem

    Remote MCP deployments introduce security and architectural questions, but structured server-side empirical measurement of the landscape has been lacking.

    Source: §I · p. 1

  • Method

    The study applies a three-tier observability framework to a stratified sample of 179 endpoints from two public registries.

    Source: §IX · p. 6

  • Results

    HHI was 0.736, with AS13335 hosting 85.5% of reachable servers; 94.6% of commercial PaaS-hosted servers enforced gateway-layer OAuth 2.1 with PKCE, and 82.9% of the reachable ecosystem was opaque to automated security analysis.

    Source: §IX · p. 6

  • Takeaways & Limitations

    In this dataset, platform-level authentication adoption reduces the feasible domain for Tier 2 measurement, creating a Security-Observability Tradeoff for automated assessment.

    Source: §I · p. 2, §IX · p. 6

    The cross-sectional June 2025 sample covers two public registries, Tier 2 analysis is limited to seven open servers, and the hosting-authentication correlation is not causal evidence.

    Source: D. Limitations · p. 6

Abstract

from arXiv · show

The Model Context Protocol (MCP) has emerged as the dominant interface for connecting autonomous agents to external data sources and execution environments. The ecosystem's transition from local process execution to remote Streamable HTTP deployments introduces unmeasured architectural and security constraints at scale. This paper presents a three-tier observability framework comprising catalog metadata (O_0), passive compliance signals (O_1), and live vulnerability analysis (O_2), applied to empirically characterize the public MCP server ecosystem. Evaluation of a stratified sample of 179 remote endpoints across two primary public registries reveals significant infrastructural consolidation. The Herfindahl-Hirschman Index (HHI) computed over the Autonomous System Number (ASN) distribution yields a value of 0.736, well above the 0.25 threshold for a highly concentrated market. Analysis further indicates that server authentication is strongly correlated with hosting platform choice rather than individual operator configuration, with 95\% of commercial PaaS-hosted servers enforcing gateway-level OAuth 2.1 with PKCE. The empirical results identify a Security-Observability Tradeoff observed in the current ecosystem: the platform-level authentication mechanisms that secure the majority of servers simultaneously limit automated vulnerability scanning capabilities, constraining the ability of AI gateway operators to assess tool-poisoning vectors without prior credential provisioning.

I. INTRODUCTION

As MCP deployments move from local processes to remote services, gateway operators need ways to assess server trust before integration. This study measures the remote server landscape and examines how hosting and authentication shape what operators can observe.

I. INTRODUCTION

  • Remote servers can expose LLM-integrated agents to indirect prompt injection and tool poisoning through manipulated schemas, motivating security assessment before provisioning.The risk is compounded by autonomous clients; gateway operators need to assess a server before adding it to an active agent pipeline.Source: §I · p. 1
  • A server-side measurement study addresses the lack of structured empirical evidence about remote MCP deployments, complementing prior local-vulnerability and client-side registry analyses.The study asks whether gateway operators have sufficient visibility to make informed trust decisions about remote servers.Source: §I · p. 1
  • The Security-Observability Tradeoff links platform-level authentication to reduced automated scanning, while hosting concentration raises the possibility of ecosystem-wide disruption from a provider outage.The introduction frames these as connected concerns for gateway integration workflows.Source: §I · p. 1
  • The paper introduces a three-tier observability framework and reports high ASN-level hosting concentration, with HHI 0.736.It also finds authentication posture strongly correlated with platform architecture and characterizes platform authentication as limiting automated verification of tool safety.Source: §I · pp. 1–2

II. BACKGROUND AND RELATED WORK

The background frames remote MCP as a standardized interface for agent tools and situates this study at the intersection of tool-poisoning risk and infrastructure centralization. Its server-side measurement extends earlier work on internet centralization to AI-agent tooling.

A. The Model Context Protocol

  • The June 2025 MCP specification formalized Streamable HTTP as canonical remote transport and mandated OAuth 2.1 with PKCE S256 for hosted, multi-tenant deployments.MCP defines Tools, Resources, and Prompts as its three client-server interaction primitives.Source: A. The Model Context Protocol · p. 2

B. Tool Poisoning and Indirect Prompt Injection

  • Tool poisoning embeds adversarial instructions in tool names, descriptions, or schemas, which an LLM client may process as legitimate context and use to exfiltrate data or make unauthorized calls.The threat is situated among trust-boundary violations in multi-agent systems and analogous A2A risks.Source: B. Tool Poisoning and Indirect Prompt… · p. 2

C. Internet Infrastructure Centralization

  • Applying the Herfindahl-Hirschman Index to MCP deployments extends infrastructure-centralization measurement to AI-agent tooling.Prior work documented DNS query concentration and shared-provider dynamics in web hosting.Source: C. Internet Infrastructure… · p. 2

D. Ecosystem Measurement for AI Protocols

Earlier AI-protocol measurement focused on interoperability, transport, congestion, or client-side behavior, rather than remote server deployment and its security visibility. The paper separates observability into three tiers aligned with stages of gateway integration.

D. Ecosystem Measurement for AI Protocols

  • Unlike client-focused MCPCrawler registry aggregation, this study measures remote server deployments and addresses the Security-Observability Tradeoff.Prior work also covered interoperability and transport and congestion control; MCPCrawler found SSE dominant in a 2025 prerevision dataset.Source: D. Ecosystem Measurement for AI… · p. 2

A. Overview and Formal Framework

  • The framework distinguishes catalog metadata available without connecting (O0), passive signals after protocol connection (O1), and active security analysis (O2) when unauthenticated tool enumeration is permitted.The tiers correspond to successive phases of a gateway operator's server integration process.Source: A. Overview and Formal Framework · p. 2

B. Data Collection and Stratified Sampling

The study samples remote endpoints from two public registries, stratifying Smithery by adoption tier and taking a census of the official registry. It also defines catalog metadata as the information available before contacting a server.

B. Data Collection and Stratified Sampling

  • The two registries were selected as the only publicly accessible, API-queryable remote-server directories, leaving private, corporate, and invite-only registries outside the sample.Those registries are not discoverable through public interfaces without privileged access.Source: B. Data Collection and Stratified… · pp. 2–3
  • Smithery contributed 150 servers sampled equally from its top-50, ranks 201–250, and ranks 1001–1050; all 29 remote-capable Official MCP Registry endpoints were included.The stratification represents high-adoption, mid-tier, and long-tail servers rather than only popular listings.Source: B. Data Collection and Stratified… · p. 3
  • Of 179 endpoints attempted, 76 (42.5%) accepted TCP connections within 5000 ms; the others timed out or returned terminal HTTP 4xx/5xx errors.The study interprets this as consistent with registered endpoints that are not actively maintained; Table I presents the cross-registry breakdown.Source: B. Data Collection and Stratified… · p. 3, Table I · p. 3

C. Tier 0: Catalog Metadata

  • O0 catalog features are extracted before network contact and include description, categorical tags, declared transport and protocol version, and source registry.Popularity proxies such as useCount and the verified badge are excluded to measure intrinsic server characteristics rather than platform endorsement.Source: C. Tier 0: Catalog Metadata · p. 3

D. Tier 1: Post-Connection Passive Probing

Tier 1 probes reachable servers after connection to collect passive compliance signals, but authentication challenges prevent O1 collection before the MCP handshake completes.

D. Tier 1: Post-Connection Passive Probing

E. Tier 2: Live Security Analysis

The study measures remote-server security and infrastructure across registry and network layers, finding high ASN concentration alongside sharply segregated registry hosting.

E. Tier 2: Live Security Analysis

  • Tier 2 security labels came from scanning tool schemas for prompt-injection patterns and semantic poisoning, with 401/403 responses classified as AUTH_GATED.Source: E. Tier 2: Live Security Analysis · p. 3

A. Cross-Registry Infrastructure Analysis

B. ASN-Level Concentration

V. AUTHENTICATION AS A PLATFORM PROPERTY

Authentication-gating rates differed between Smithery-hosted and externally hosted servers, and the cross-sectional comparison cannot establish why.

A. Posture Distribution by Hosting Type

B. OAuth 2.1 at the Gateway Layer

Gateway-level OAuth 2.1 with PKCE is consistent with authentication being a hosting-platform default rather than an individual operator choice. Among the seven externally hosted open servers, compliance was adequate but incomplete.

B. OAuth 2.1 at the Gateway Layer

  • The measurement found zero Smithery servers permitted unauthenticated access, compared with 35% of external servers, consistent with hosting-platform defaults rather than individual operator security practice.The June 2025 MCP specification mandates OAuth 2.1 with PKCE S256 for hosted remote deployments, and Smithery implements it at the gateway layer.Source: B. OAuth 2.1 at the Gateway Layer · p. 4

C. Compliance Characteristics of the Open Population

  • Among seven externally hosted open servers, mean composite compliance was 0.74, indicating adequate but incomplete adherence to specification recommendations.All seven enforced HTTPS; mean schema quality was 0.61, and tool counts ranged from 0 to 13 (mean 7.3, median 6).Source: C. Compliance Characteristics of the… · pp. 4–5
  • Fig. 4 stratifies security posture by hosting infrastructure type.The supplied caption identifies the grouping but does not state the figure’s cell values.Source: Figure 4 · p. 5

A. Classifier Design

The study tested whether catalog metadata and passive compliance signals could predict live security verdicts, but the available open-server set produced a single-class outcome. Tier 2 analysis is defined only for servers permitting unauthenticated enumeration, leaving most measured servers outside its domain.

A. Classifier Design

  • The classifier combined a 384-dimensional O0 description embedding with five O1 scalar features and used L2 regularization with C = 1.0.It was trained to predict the AgentSeal SAFE versus NEEDS_REVIEW verdict.Source: A. Classifier Design · p. 5

B. Single-Class Degeneracy

  • All seven servers with O1 and O2 data were SAFE, so the single-class labels made prediction ill-defined and conventional significance testing unsupported.A zero-rule classifier predicting SAFE unconditionally would achieve 100% accuracy; the paper attributes the small scannable population to platform-level authentication gates.Source: B. Single-Class Degeneracy · p. 5

C. Formal Characterization

  • The Tier 2 function f maps Sopen to SAFE or NEEDS_REVIEW; Sopen is the complement of the platform-authenticated subset of reachable servers.The full remotely reachable population is denoted S, and the function is defined only over Sopen.Source: C. Formal Characterization · p. 5
  • 82.9% of reachable servers were outside Tier 2 analysis in the June 2025 measurement, and the paper cautions this is not universal across deployment architectures.Alternative designs, including a proposed transparency log, could decouple authentication from observability.Source: C. Formal Characterization · p. 5

VII. DISCUSSION

The measured ecosystem’s concentrated infrastructure creates exposure to disruptions affecting its dominant network provider, while platform authentication limits active security analysis. The discussion proposes gateway and protocol design responses, explicitly presenting protocol extensions as unvalidated directions.

A. Centralization as a Systemic Risk

  • An HHI of 0.736 and 85.5% single-ASN dominance mean a disruption or incident affecting that ASN could degrade or compromise connectivity for most of the ecosystem.The paper compares this dependency structure to centralized DNS resolver single points of failure.Source: A. Centralization as a Systemic Risk · p. 5

B. Design Implications for Gateway Operators

  • Because active scanning was unavailable for 82.9% of the measured ecosystem, the paper recommends credential provisioning before assessment and tracking O0/O1 signals during onboarding.It also proposes signed tool manifests and differential trust policies for PaaS-hosted versus externally hosted servers.Source: B. Design Implications for Gateway… · p. 5

C. Protocol-Level Governance

  • A proposed Tool Schema Transparency Log would let gateways verify signed schema versions against OAuth-handshake hashes without unauthenticated enumeration.Standardized catalog fields schema_hash, scan_attestation_uri, and last_scan_timestamp are also proposed; these directions are not validated solutions and require further specification and community review.Source: C. Protocol-Level Governance · pp. 5–6

D. Limitations

The study’s findings are bounded by a June 2025 cross-sectional sample from two public registries and only seven open servers for Tier 2 analysis. The conclusion reports high network-layer consolidation and platform-correlated authentication, alongside substantial opacity to automated analysis.

D. Limitations

  • Tier 2 analysis covered only seven open servers, too few for statistical generalization about tool-poisoning prevalence; hosting-authentication correlation is not causal evidence.The study is a June 2025 snapshot of two public registries, excluding enterprise-internal, invite-only, and privately hosted servers; longitudinal measurement could strengthen support.Source: D. Limitations · p. 6

VIII. ETHICS

  • The measurement used deterministic handshakes and did not invoke tools/call or execute server-side tools; it used no third-party credentials or tokens.The crawler was limited to three concurrent connections and a one-second inter-request delay per target.Source: §VIII · p. 6

IX. CONCLUSION

  • Across 179 endpoints from two public registries, the study reports HHI 0.736, 85.5% hosted on AS13335, and 82.9% opaque to automated security analysis.It reports 94.6% of commercial PaaS-hosted servers enforcing gateway OAuth 2.1 with PKCE and identifies longitudinal measurement and transparency mechanisms as future work.Source: §IX · p. 6
Loading 2609.19100v1…