Agents
The remote MCP ecosystem is already a concentrated market: ASN Herfindahl-Hirschman index of 0.736
arXiv 2609.19100 (16 Sep 2026) applies a three-tier observability framework — catalog metadata, passive compliance signals, live vulnerability analysis — to a stratified sample of 179 remote MCP endpoints across two public registries. The ASN-level HHI of 0.736 sits far above the 0.25 highly-concentrated threshold, and authentication tracks hosting platform rather than operator choice: 95% of commercial PaaS-hosted servers enforce gateway-level OAuth 2.1 with PKCE. The paper names the resulting Security-Observability Tradeoff, where the same platform auth that secures most servers blocks automated tool-poisoning scans without pre-provisioned credentials.
Source
↳ Follow the thread