MCP servers change what they offer, often silently

Researchers pulled the entire public MCP registry, 21,643 servers and 72,606 version records, and fetched source for 14,353 of them. They ran each one against an eight-class threat catalogue built from 414 hand-labeled findings. Among servers with more than one version, 51.1% changed what they advertise between releases, and 40.6% did it with no changelog signal a client could act on.

The part that should worry anyone pinning a server by version string: 4.2% repointed their remote endpoint to a different host while keeping the same registry identity. The MCP registry census found the protocol has no mechanism to push that change to anything already installed. A client that approved version 1.0 has no signal that version 1.3 now talks to a different backend entirely.

Silence tracks with danger. Servers that changed their advertised surface without a visible signal carried almost three times the odds of a high-severity finding, an odds ratio of 2.96 with a 95% confidence interval of 2.56 to 3.42. Star count barely helps: each additional log-star cut the odds by only 22%, an odds ratio of 0.78. A well-starred server can still drift into a high-severity change with nothing to flag it.

The paper doesn't say whether any registry operator is building endpoint-change alerts in response, or whether this behavior clusters in a small set of publishers rather than spreading across the ecosystem. Until something like that exists, treating a pinned MCP version as static is a bet, not a fact.