Abandoned MCP domains are an allowlist problem
OX Security found expired MCP hostnames — including six $4 domains. Listings are leads. Standing configs without owners are the incident.
Source: OX Security
Abandoned MCP domains are an allowlist problem. On 24 September 2026, OX Security published a scan of 15,465 public MCP listings (5,095 unique hostnames): 15.6% resolved outside the US, 0.45% sat on home/consumer tunnels, and 2.3% no longer resolved — including six unregistered domains for about $4–$12 a year.
The protocol will not enforce residency, expiry, or ownership for you. Clients keep calling the URL in mcp.json. If the name lapses, the next registrant inherits standing approval.
Why it matters: Influzer’s catalog is ~12,150 servers and only ~386 with indexed tools. Search is not the bottleneck. An owner, a live handshake, and a write/read split are. Filter Ready surface, keep Discovery read-only, and kill any hostname you cannot name.
Full operator drill: Abandoned MCP domains are an allowlist problem. Pair with policy before plugins and honest quality labels.