51.1% of Multi-Version MCP Servers Changed What They Advertise, and 4.2% Repointed Their Endpoint to a Different Host Without Telling Clients
A census of the full public MCP registry (21,643 servers, 72,606 version records, August 2026 snapshot) fetched source for 14,353 servers and scanned them against an eight-class threat catalogue calibrated on 414 hand-labeled findings. The headline is instability rather than any single weakness: 51.1% of multi-version servers changed their advertised surface between versions, 40.6% did so silently, and 4.2% redirected their remote endpoint to a different host while keeping their registry identity, a change the protocol never surfaces to installed clients. Silent drift carries nearly threefold higher odds of a high-severity finding (OR = 2.96, 95% CI [2.56, 3.42]), and star count is weak protection (OR = 0.78 per log star).
↳ Follow the thread