Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, and Why Drift-Ranked Re-Auditing Under-Covers It

• URL: http://arxiv.org/abs/2608.00997v2
• Date: Tue, 04 Aug 2026 23:19:10 GMT
• Title: Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, and Why Drift-Ranked Re-Auditing Under-Covers It
• Abstract summary: Security studies of the Model Context Protocol (MCP) ecosystem share a design: each audits a registry at a single point in time.<n>None reports how long the registry descriptions those audits judged stay current.<n>We reconstruct 120 observations of the official MCP registry over 88.6 days, covering 19,099 distinct servers as it grew from 3,510 to 18,966.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Security studies of the Model Context Protocol (MCP) ecosystem share a design: each audits a registry at a single point in time. None reports how long the registry descriptions those audits judged stay current - a necessary condition for any description-level finding to still apply, though not a sufficient one: we measure the shelf-life of the audited text, not the validity of a security finding itself (Sec. 7.1). We reconstruct 120 observations of the official MCP registry over 88.6 days, covering 19,099 distinct servers as it grew from 3,510 to 18,966. Our central result is a policy one: you cannot keep description-level findings current by re-auditing the servers that drift most. At a top-5% re-audit budget, ranking by prior drift catches only ~20% of the previously-seen servers whose description changes in a held-out window - versus ~27% for descriptor drift overall - and only ~10% of all description changers. The limit is not unpredictability: the ranking still buys ~4x lift. It is that the description surface is sparse - 8.6% of servers ever rewrite one, against 24.8% for descriptors - and that roughly half of all description changes land on new arrivals a history ranking cannot reach, so the same lift buys far less coverage. The control that fits is content-binding - revalidate the moment a description's hash moves - plus a sized periodic full-catalog sweep; a drift-history ranking is at best a partial, blind-to-new-arrivals control. This is scanner hygiene for a description-level auditor, not a runtime trust signal. Of servers observed across at least ten intervals, three-quarters never change, the most active 5% generate 61% of all change events, and only 11.9% of a cohort's descriptors change within 30 days; naive compounding predicts 35.8% at 30 days (73% at 89), a heavy-tail overestimate we use only as a diagnostic. We release the panel, figure generator, and analysis code.

Related papers

• Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem [0.0]
  The Model Context Protocol (MCP) has become the common interface through which large language model applications reach external tools.<n>This paper reports a census of that ecosystem.
  arXiv  Detail & Related papers  (2026-09-12T19:47:32Z)
• NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs [0.0]
  We present NovaFabric, producing audit-grade execution evidence.<n>It records an agent run, without modifying agent logic, into a portable Run Capsule.<n>Sealed runs are re-executable under a four-mode replay protocol.<n>We evaluate eight research questions at measured scope.
  arXiv  Detail & Related papers  (2026-09-11T08:35:43Z)
• When Agent Metrics Measure Different Things: An Evidence-Grounded Audit of the Praxa AI Pipeline [0.0]
  We present a retrospective measurement audit of selected Praxa AI implementation files, historical evaluation artifacts, and operational records.<n>A 139-case offline routing report contains 112 passes and 27 failures despite zero gating failures.<n>The pooled recorded 99th percentile is 2,147,483,647 ms, versus 38,118.31 ms among server-observed completed calls.
  arXiv  Detail & Related papers  (2026-09-10T07:55:12Z)
• RobustSGPO: Search-Space Control for Agent Harness Evolution [56.722805974785125]
  We introduce RobustSGPO, which specifies the requested edit, constructs and checks the patch, and continues search from either the incumbent or retained snapshots.<n>We evaluate permission scheduling, cumulative controls, and task-family transfer in the AgentX brainstorming workflow using 120 tasks, 95 runs, and 7,350 candidate attempts.
  arXiv  Detail & Related papers  (2026-09-09T03:00:03Z)
• CURA: Certified Runtime Alarms for Computer-Use Agents [6.896160570537455]
  Self-report is the cheapest oversight channel a deployer has, and on capable computer-use agents it fails precisely where oversight matters.<n>On 361 OSWorld tasks our pipeline, a read-only feasibility gate, a planner, and an executor, reaches a mean task score of 82.9, above the 72.4 human reference.<n>64 of its 71 failures (90%) end with a success claim, acknowledging no explicit failure affordance is never used in roughly 9,100 calls.<n>Alarm-gated mid-execution oversight recovers 23 of 70 failures while spending a frontier overseer on 38, giving a deployable
  arXiv  Detail & Related papers  (2026-08-28T00:50:47Z)
• ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices [48.36933831982682]
  We introduce ADeptS-Bench, a trustworthiness benchmark grounded in the ADEPTS capability framework.<n>The Safety stream provides paired benign/malicious tasks with threats embedded in the visual interface.<n>The Disambiguation stream evaluates whether agents seek clarification when intent is ambiguous.
  arXiv  Detail & Related papers  (2026-08-25T23:21:57Z)
• Turning Interaction History into Execution State: A Runtime Layer for Long-Horizon Coding Agents [48.967927222079965]
  Ledger is a runtime layer that distills an agent's completed interactions into an explicit execution state.<n> Ledger keeps this state in an online execution ledger and applies it at two boundaries of every step.<n>Across all 500 SWE-bench Verified instances, Ledger raises Pass@1 from 56.2% to 64.2% with GPT-5 mini and from 75.8% to 81.0% with MiniMax M2.5.
  arXiv  Detail & Related papers  (2026-08-01T18:25:00Z)
• DarwinX: Evolving Agent Harnesses Through Natural Selection [48.64258219266629]
  DarwinX treats self-evolution as selection over a population of harnesses with the model frozen.<n>General agent competence, not benchmark-specific patches, so it survives changes of task, verifier, and base model.
  arXiv  Detail & Related papers  (2026-07-31T05:34:02Z)
• Mean Time to Remediate Is Not a Fielding Model: A Cadence Audit for Enterprise Vulnerability Management [51.56484100374058]
  This paper introduces a remediation-cadence audit for enterprise vulnerability management.<n>It records routine mean lag, release period, release fraction, cohort geometry, emergency/routine split, non-fielding delay, local residual-pressure evidence, and declared rate scenario.
  arXiv  Detail & Related papers  (2026-07-05T21:23:26Z)
• DriftScope: Measuring The Hidden Effects of Diffusion Model Adaptation [50.584834483403675]
  Adapting pre-trained text-to-image diffusion models, whether to learn new visual concepts or erase unwanted ones, is routinely evaluated on its intended effects alone.<n>We demonstrate that adaptation systematically damages semantically unrelated concepts in ways that aggregate metrics structurally cannot surface.<n>We introduce DriftScope, a prompt-level diagnostic tool that takes any two model checkpoints and returns a ranked list of tokens whose visual concepts have shifted most between them.
  arXiv  Detail & Related papers  (2026-06-30T20:57:51Z)
• Auditing Generalization in AI-Generated Video Detection: A Six-Control Protocol and the VidAudit Toolkit [8.665845754660458]
  AI-generated video detection GenVidBench and AIGVDBench are the de facto leaderboards.<n>Most evaluation protocols leave uncontrolled confounds that can inflate reported generalizations.<n>A 20-paper survey finds none applying all six standard controls that would catch this.<n>We combine them into an audited protocol and apply it to six representative feature sources.
  arXiv  Detail & Related papers  (2026-06-30T00:29:53Z)
• Self-Conditioned Positional HNSW for Overlap-Aware Retrieval in Chunked-Document RAG Systems: Method and Industrial Evidence-Quality Audit [0.0]
  Chunked-document retrieval is a common component of retrieval-augmented generation (RAG) systems.<n>We propose Self-Conditioned Positional HNSW, a lightweight modification that appends a low-dimensional positional code to chunk embeddings.
  arXiv  Detail & Related papers  (2026-06-01T01:42:55Z)
• Hierarchical Online Prompt Mutation with Dual-Loop Feedback for Guardrailed Evidence Document Generation: A Production-Evaluation Case Study [0.0]
  HOPM is a hierarchical online prompt mutation framework evaluated on a real marketplace dispute-evidence workflow.<n>The paper includes control setup, sample sizes, confidence intervals, paired tests, prompt-token categories, pseudocode, schema, rubric, guardrail taxonomy, and a constructed example.
  arXiv  Detail & Related papers  (2026-05-31T22:17:44Z)
• Reading Task Failure Off the Activations: A Sparse-Feature Audit of GPT-2 Small on Indirect Object Identification [0.0]
  We report a small, reproducible audit of sparse-autoencoder (SAE) features of GPT-2 small fire differently on failed versus successful trials.<n>On 300 prompts, GPT-2 small reaches 79.7% accuracy; 146 of the 24,576 features in the layer-8 residual-stream SAE release of Bloom (2024) clear a Holm-corrected significance threshold.<n>The strongest single correlate of failure -- feature 17,491, d=+2.93, Neuronpedia label 'cryptographic keys' -- is essentially silent except when the prompt's transferred object is 'the keys'
  arXiv  Detail & Related papers  (2026-05-21T16:55:27Z)
• Code-Centric Detection of Vulnerability-Fixing Commits: A Unified Benchmark and Empirical Study [4.512751676075442]
  We present a comprehensive evaluation of code language model based VFC detection through a unified framework.<n>We find no evidence that models acquire transferable security-relevant code understanding from code changes alone.<n>Group-stratified evaluation exposes approximately 17% performance drops compared to random splits.
  arXiv  Detail & Related papers  (2026-05-13T08:05:14Z)
• How Far Is Document Parsing from Solved? PureDocBench: A Source-TraceableBenchmark across Clean, Degraded, and Real-World Settings [56.70440596502351]
  The past year has seen over 20 open document parsing models, yet benchmarks almost exclusively on OmniDocBench.<n>We present PureDocBench, a benchmark thatrenders document images from HTML/CSS, covering 10 domains, 66 pages, and 1,475 pages.
  arXiv  Detail & Related papers  (2026-05-08T09:30:31Z)
• ClawMark: A Living-World Benchmark for Multi-Turn, Multi-Day, Multimodal Coworker Agents [77.22389710754452]
  We introduce bench, a benchmark for coworker agents built around multi-turn multi-day tasks.<n>The current release contains 100 tasks across 13 professional scenarios, executed against five stateful sandboxed services.<n>The strongest model reaches 75.8 weighted score, but the best strict Task Success is only 20.0%, indicating that partial progress is common.
  arXiv  Detail & Related papers  (2026-04-26T16:05:02Z)
• ES-Net: Erasing Salient Parts to Learn More in Re-Identification [46.624740579314924]
  We propose a novel network, Erasing-Salient Net (ES-Net), to learn comprehensive features by erasing the salient areas in an image. Our ES-Net outperforms state-of-the-art methods on three Person re-ID benchmarks and two Vehicle re-ID benchmarks.
  arXiv  Detail & Related papers  (2021-03-10T08:19:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.