Two arXiv studies expose concentration and tool-hallucination risks in the remote MCP ecosystem

Two cs.CR papers published 2026-09-16 measure the remote Model Context Protocol ecosystem: a study of 179 remote MCP endpoints finds heavy hosting concentration (HHI 0.736) with platform-enforced OAuth 2.1 limiting security scanning, while a benchmark across…

Two arXiv cs.CR papers published on 2026-09-16 characterize security weaknesses in the remote Model Context Protocol (MCP) ecosystem. The first applies a three-tier observability framework (catalog metadata, passive compliance signals, live vulnerability analysis) to a stratified sample of 179 remote MCP endpoints from two public registries and finds heavy infrastructure concentration: the Herfindahl-Hirschman Index over ASN distribution is 0.736, well above the 0.25 high-concentration threshold. 95% of commercial PaaS-hosted servers enforce gateway-level OAuth 2.1 with PKCE, and authentication correlates strongly with hosting platform choice rather than operator configuration, creating a security-observability tradeoff that constrains automated scanning for tool-poisoning vectors without prior credentials. The second paper introduces a five-class taxonomy (H1-H5) of tool hallucination in LLM agents, where models call nonexistent tools or pass arguments no schema declares - a blind spot no gating defense can reject, since no gate made the decision. Across ten hosted models on two invocation surfaces, researchers measured 322 genuine hallucinations, concentrated on the unconstrained raw-JSON surface (34 versus 3), and a 675B model performed no better than a 7-8B model. On MCP, merging servers into one namespace produced 154 hallucinations, including from frontier models that were clean on the single-registry surface. The versioned Hallucinated-Tools Benchmark (HTB) was released for comparable resolver evaluation. The two studies are complementary: the first identifies observability limits in the concentrated MCP hosting infrastructure, the second shows the hallucination risks that automated defenses must resolve, including on MCP's merged-namespace surface.

• Sample of 179 remote MCP endpoints drawn from two public registries, analyzed via a three-tier observability framework (catalog metadata, passive compliance signals, live vulnerability analysis).
• Herfindahl-Hirschman Index of 0.736 over ASN distribution, well above the 0.25 high-concentration threshold, indicating heavy infrastructure concentration in remote MCP hosting.
• 95% of commercial PaaS-hosted MCP servers enforce gateway-level OAuth 2.1 with PKCE.
• Authentication is strongly determined by hosting platform choice, not operator configuration, creating a security-observability tradeoff that limits automated tool-poisoning scanning without prior credentials.
• Five-class taxonomy (H1-H5) of tool hallucination in LLM agents, with proof that defense must precede any gate since no gate made the decision.
• 322 genuine hallucinations measured across ten hosted models on two invocation surfaces.
• Fabricated-tool calls concentrate on unconstrained raw-JSON surfaces: 34 versus 3.
• Model scale does not help: a 675B model matched a 7-8B model on hallucination rates.