AI agents 2026 run on MCP servers — but most people never asked where those servers actually live. On October 6, 2026, Ox Security reported finding 15,465 MCP servers with zero governance — and 2.3% of them sat on dangling domains: expired or abandoned hostnames that anyone can re-register. When that happens, your agent keeps connecting to the same trusted name — now operated by a stranger. This page scores every origin in your own MCP config, right here, before that stranger is on the other end of your tools.
The short answer: an MCP origin is hygienic if it is a stable domain the publisher controls, over HTTPS, on a standard port, with no credentials in the URL. It is RISKY when it is a tunnel endpoint, a raw IP, plaintext HTTP, a punycode or dynamic-DNS host, or a URL with embedded credentials — and a local server is REVIEW when it launches through a shell or is handed secret-named environment variables. Paste your config below and get a per-server verdict: CLEAN, REVIEW or RISKY, with the reason for every flag.
🔒 Your config NEVER leaves your browser. This checker is pure client-side JavaScript: it makes no network requests, sends nothing to Ingenious AI or anyone else, and stores nothing. Env values are never displayed — only variable names are flagged. Close the tab and the paste is gone. Don't take our word for it: the same checks run offline in the open-source mcp-origin-hygiene tool by Ingenious AI.
MCP origin hygiene means knowing — and being able to defend — the actual network origin every Model Context Protocol server in your agent's config points at: who owns the domain, how it is reached, and what happens if that origin changes hands.
Source: Ox Security research, reported October 6, 2026 (figures as reported by Ox Security; treat as the researcher's published findings). The pattern that matters for your config:
Your client does not warn you about any of this. It resolves the name, connects, and hands the server your context. Origin hygiene is the check nobody runs — so run it now.
Paste your MCP client config JSON — the standard mcpServers format used by Claude Desktop, Cursor, VS Code and most MCP clients. Remote servers (with a url) are scored on their origin; local servers (with a command) are flagged for shell launches and secret-named env vars.
xn--): the encoding behind lookalike-domain spoofing. Verify you intended exactly that domain.@ leaks into logs, history, screenshots and crash reports.sh, bash, powershell…) or shell operators in args mean the config itself is executable code; secret-named env vars (*_API_KEY, *_TOKEN, *_SECRET…) are what a rogue server reads first.This page is the quick check. The full open-source tool — mcp-origin-hygiene by Ingenious AI (queued for publication) — runs the same origin scoring as a local CLI over whole config folders, with dangling-domain heuristics and a CI-friendly report, still with zero network calls against your config contents.
A dangling domain is a hostname an MCP server was configured to trust whose registration has lapsed or whose DNS record points at a resource nobody controls anymore. Anyone can re-register the expired domain or claim the abandoned subdomain, put a server behind it, and your MCP client connects to the stranger's server believing it is the original — same config, same trusted name, different operator. Because MCP servers receive your prompts, files and tool results, a hijacked connection is a silent man-in-the-middle with your agent's full context.
Yes — for short-lived local development, on your own machine, while you are watching. A tunnel is a problem when it becomes permanent infrastructure in a shared or production config: free tunnel hostnames are ephemeral, can be reassigned to someone else when they expire, rarely have stable ownership, and bypass the network controls you would apply to a real deployment. If a tunnel URL is still in your config next week, treat it as RISKY and move the server to a domain you own.
Two settings multiply the damage: always-allow tool approvals, which let a server run its tools without asking you, and broad secret access, such as an .env file or environment variables carrying API keys the server can read or exfiltrate. A rogue or hijacked server with always-allow plus your .env can call tools, read credentials and ship data out in one session — before you see a single prompt. Keep approvals manual for new servers and give each server only the secrets it strictly needs.
Check who publishes it and whether the project is maintained; read the source or at least the tool list it exposes; prefer servers pinned to a version you chose over auto-updating installs; confirm the origin is a domain the publisher controls (not a tunnel, raw IP or dynamic-DNS host); start with read-only tools and manual approvals; and give it scoped, revocable credentials instead of your personal keys. Re-run this origin check whenever the config changes.
Related checks:
Get early access to the Ingenious AI platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI
Get early access on WhatsApp →
Finding cited on this page: Ox Security research reported October 6, 2026 (15,465 MCP servers with zero governance; 2.3% on dangling domains) — figures as published by the researcher. The checker above is a heuristic origin review of the config text you paste: it cannot prove who operates a server today, and a CLEAN verdict is not a safety guarantee — vet servers per the FAQ. It runs entirely in your browser; nothing you paste is transmitted or stored.