Model context protocol servers face silent endpoint changes risks
Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem
Cryptography and SecuritySoftware Engineering
Summary
Large language model applications use many external tools registered in a public directory. The authors found that over half of these tools frequently change their advertised addresses without warning, sometimes redirecting traffic to new hosts silently. These hidden changes make the tools almost three times more likely to have serious security problems. They also show that popularity ratings don’t reliably indicate safety. The researchers suggest ways to improve registry design and client protections.
What this means in practice
- •For software security teams: Identify insecure MCP servers by scanning for silent endpoint changes linked to security risks in tool registries.
- •For platform engineers: Design MCP registries to detect and prevent silent drift, improving stability and trustworthiness of registered tools.
Authors
Obada Kraishan
Abstract
The Model Context Protocol (MCP) has become the common interface through which large language model applications reach external tools, and its public registry now distributes thousands of community-built servers with little of the vetting infrastructure that mature package ecosystems have accumulated. This paper reports a census of that ecosystem. We harvested the full public MCP registry (21,643 servers, 72,606 version records, August 2026 snapshot), fetched source code for 14,353 servers, and applied a pattern-based scanner covering an eight-class threat catalogue whose accuracy we measured against 414 hand-labeled findings. Observed prevalence is dominated by unauthenticated network exposure (9.57% of scanned servers); after correcting each class by its measured precision, 11.14% observed high-severity prevalence reduces to roughly 7.6%. The central finding concerns instability rather than any single weakness: 51.1% of multi-version servers changed what they advertise between versions, 40.6% did so silently, and 4.2% redirected their remote endpoint to a different host while keeping their registry identity, a change the protocol never surfaces to installed clients. Silent drift is associated with nearly threefold higher odds of a high-severity finding (OR = 2.96, 95% CI [2.56, 3.42]). Popularity offers only weak protection (OR = 0.78 per unit of log stars), so star counts are a poor proxy for safety. We derive concrete recommendations for registry design, client-side pinning, and scanner triage, and release an anonymized artifact.