{
 "public_id": "AIR-2026-0152",
 "incident_id": "2026-07-upguard-mcp-registry-typosquatting",
 "date_disclosed": "2026-07-02",
 "date_occurred": null,
 "title": "UpGuard: 10-16% of servers across major MCP registries are unverified lookalikes of official brand servers",
 "class": "research_demo",
 "attack_surface": "mcp_server",
 "initial_vector": "name_confusion_in_unvetted_registries",
 "agent_capability_abused": [
  "mcp_server_selection",
  "tool_invocation"
 ],
 "target_product": "MCP.so, Smithery, GitHub MCP registry and other MCP directories",
 "target_vendor": "multiple registries",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "credential_theft"
 ],
 "blast_radius": "18,000 Claude Code settings files analysed from public GitHub repos; MCP.so alone hosts 17,000+ servers",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI04",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "typosquatting",
   "affix_squatting",
   "registry_vetting",
   "name_confusion",
   "missing_verification_badges"
  ]
 },
 "defense_present": "partial verification badges - only 8% of 847 sampled Smithery servers carried one",
 "defense_bypassed": true,
 "fix_shipped": "none - structural finding",
 "primary_sources": [
  "https://www.upguard.com/blog/typosquatting-in-the-mcp-ecosystem"
 ],
 "verified_quote": "AI agent systems are human-configured, and humans are prone to mistakes. While a misspelled name seems minor, in an AI ecosystem, it's a direct invitation for an attacker to step in.",
 "confidence": "high",
 "notes": "Measurement study rather than a single incident. For every official brand server there were 3-15 unverified lookalikes using the identical brand name; nine different 'Hubspot' MCP servers were live with only one from HubSpot, all receiving traffic. Popular 'GitHub' MCP servers were found running code from personal accounts such as GigaChatTester. Also documents affix-squatting (package-mcp-server vs package-mcp) as distinct from classic typosquatting.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "brand_trust"
 ],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Credential & Secret Theft"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "agents select the lookalike registry servers and invoke their tools",
 "vector_family": "other",
 "vector_detail": "name_confusion_in_unvetted_registries",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "mcp_server",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "credential_theft",
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI04 (eai_category=supply_chain_vulnerabilities), ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}