MCP drift-ranking catches 10% of description rewrites

An 89-day reconstruction of the MCP registry found that ranking servers by drift history catches only 10% of the servers that rewrite their descriptions, per arXiv 2608.00997.

That's the catch rate at a top-5% re-audit budget, the size a registry can realistically run. Miss the other 90%, and a server can rewrite its description into something malicious after approval, with no history-based check flagging it.

History-based ranking isn't worthless. It buys roughly 4x lift over random checks. But two facts cap how far that lift reaches: only 8.6% of servers in the registry ever rewrite a description at all. Close to half of the rewrites that do happen land on new arrivals, servers with no drift history for a ranking to read.

The registry's growth compounds the problem. It grew from 3,510 to 18,966 servers over the study's window, putting more risk in servers too young to have any history.

The paper's proposed fix is content-binding: tie trust to a hash of the current description, and re-audit the moment that hash changes. Back that with a periodic sweep sized to catch the servers a ranking system can't reach.

This isn't really a ranking-algorithm problem. It's the assumption that trust accrues with history in a registry adding servers faster than any of them can build one. Watch whether the registry adopts hash-triggered re-audits, or keeps tuning a reputation score that structurally can't reach half its risk.