Research demo
UpGuard: 10-16% of servers across major MCP registries are unverified lookalikes of official brand servers
AIR-2026-0152 AIR record · 2026-07-upguard-mcp-registry-typosquatting
From the supporting source
AI agent systems are human-configured, and humans are prone to mistakes. While a misspelled name seems minor, in an AI ecosystem, it's a direct invitation for an attacker to step in.upguard.com
The record
Disclosed
2026-07-02
Vendor
multiple registries
Product
MCP.so, Smithery, GitHub MCP registry and other MCP directories
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
Agent acted (contested) — agents select the lookalike registry servers and invoke their tools
Attack surface
MCP server
Autonomy level
Semi-autonomous
Initial vector
Name confusion in unvetted registries
Impact type
Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
18,000 Claude Code settings files analysed from public GitHub repos; MCP.so alone hosts 17,000+ servers
Capability abused
Defense & remediation
Recorded defense
partial verification badges - only 8% of 847 sampled Smithery servers carried one
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none - structural finding
Taxonomy & references
Curator notes
Measurement study rather than a single incident. For every official brand server there were 3-15 unverified lookalikes using the identical brand name; nine different 'Hubspot' MCP servers were live with only one from HubSpot, all receiving traffic. Popular 'GitHub' MCP servers were found running code from personal accounts such as GigaChatTester. Also documents affix-squatting (package-mcp-server vs package-mcp) as distinct from classic typosquatting.
Supporting sources
Cite as
Enkrypt AI. "UpGuard: 10-16% of servers across major MCP registries are unverified lookalikes of official brand servers". AIR, AIR-2026-0152. https://agentincident.vercel.app/i/AIR-2026-0152/ (accessed 2026-10-19).