Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem

• URL: http://arxiv.org/abs/2609.14119v1
• Date: Sat, 12 Sep 2026 19:47:32 GMT
• Title: Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem
• Abstract summary: The Model Context Protocol (MCP) has become the common interface through which large language model applications reach external tools.<n>This paper reports a census of that ecosystem.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The Model Context Protocol (MCP) has become the common interface through which large language model applications reach external tools, and its public registry now distributes thousands of community-built servers with little of the vetting infrastructure that mature package ecosystems have accumulated. This paper reports a census of that ecosystem. We harvested the full public MCP registry (21,643 servers, 72,606 version records, August 2026 snapshot), fetched source code for 14,353 servers, and applied a pattern-based scanner covering an eight-class threat catalogue whose accuracy we measured against 414 hand-labeled findings. Observed prevalence is dominated by unauthenticated network exposure (9.57% of scanned servers); after correcting each class by its measured precision, 11.14% observed high-severity prevalence reduces to roughly 7.6%. The central finding concerns instability rather than any single weakness: 51.1% of multi-version servers changed what they advertise between versions, 40.6% did so silently, and 4.2% redirected their remote endpoint to a different host while keeping their registry identity, a change the protocol never surfaces to installed clients. Silent drift is associated with nearly threefold higher odds of a high-severity finding (OR = 2.96, 95% CI [2.56, 3.42]). Popularity offers only weak protection (OR = 0.78 per unit of log stars), so star counts are a poor proxy for safety. We derive concrete recommendations for registry design, client-side pinning, and scanner triage, and release an anonymized artifact.

Related papers

• Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale [54.83971397981572]
  Language-model agents increasingly operate over complete software repositories.<n> cybersecurity evaluations measure whether they can detect, reproduce, or repair vulnerabilities rather than whether they can locate the relevant code.<n>We study vulnerability localization: given a weakness class and an unfamiliar repository, identify the implementation files associated with that weakness.
  arXiv  Detail & Related papers  (2026-09-14T17:44:51Z)
• Vulnerabilities, Secrets and Misconfiguration in the Highest-Exposure Docker Hub Images [0.0]
  ChimangoScan crawls the Docker Hub (12,716,568 repositories, 66 billion cumulative pulls)<n>It ranks images by an exposure score that folds an image's own pull count and those of its entire downstream subtree into one scalar.<n>It scans the 52,895 highest-exposure repositories with six independent scanners, yielding 170.4 million findings.
  arXiv  Detail & Related papers  (2026-08-02T13:57:28Z)
• Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, and Why Drift-Ranked Re-Auditing Under-Covers It [0.0]
  Security studies of the Model Context Protocol (MCP) ecosystem share a design: each audits a registry at a single point in time.<n>None reports how long the registry descriptions those audits judged stay current.<n>We reconstruct 120 observations of the official MCP registry over 88.6 days, covering 19,099 distinct servers as it grew from 3,510 to 18,966.
  arXiv  Detail & Related papers  (2026-08-02T04:54:06Z)
• Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale [0.0]
  Model Context Protocol (MCP) has seen rapid adoption since its November 2024 launch, with over 21,000 server instances detectable on the public internet.<n>We present the first dynamic behavioral security assessment of internet-facing MCP servers.<n>We use Corvus, a purpose-built framework implementing 34 test modules covering 10 MCP-specific vulnerability classes.
  arXiv  Detail & Related papers  (2026-07-31T16:46:19Z)
• Industry Classification of GitHub Repositories Using the North American Industry Classification System (NAICS) [46.877501276559165]
  GitHub hosts hundreds of millions of public repositories, but the platform exposes no native mapping from repositories to standardized industry sectors.<n>We present NAICS-GH, a publicly released corpus of 6,588 GitHub repositories drawn from source pools covering the United States, the European Union, and Australia.<n>Labels are produced by a retrieve-and-verify pipeline that combines BAAI/bge-large-en embeddings, FAISS retrieval, and GPT-4.1 scoring.
  arXiv  Detail & Related papers  (2026-07-07T17:06:32Z)
• Empirical Software Engineering TerraProbe: A Layered-Oracle Framework for Detecting Deceptive Fixes in LLM-Assisted Terraform [0.0]
  Security misconfigurations in Terraform Infrastructure-as-Code are a growing risk in cloud deployments.<n>Existing evaluations often treat a repair as successful when the targeted static-analysis finding disappears.<n>This paper presents TerraProbe, a five-layer oracle framework for evaluating LLM-assisted Terraform security repair.
  arXiv  Detail & Related papers  (2026-06-25T04:21:15Z)
• How Far Is Document Parsing from Solved? PureDocBench: A Source-TraceableBenchmark across Clean, Degraded, and Real-World Settings [56.70440596502351]
  The past year has seen over 20 open document parsing models, yet benchmarks almost exclusively on OmniDocBench.<n>We present PureDocBench, a benchmark thatrenders document images from HTML/CSS, covering 10 domains, 66 pages, and 1,475 pages.
  arXiv  Detail & Related papers  (2026-05-08T09:30:31Z)
• Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw [87.97230960702274]
  We present the first real-world safety evaluation of OpenClaw.<n>We introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions.<n>Our evaluations cover 12 attack scenarios on a live OpenClaw instance.
  arXiv  Detail & Related papers  (2026-04-06T15:27:05Z)
• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition [48.32744727426218]
  LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories.<n>This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness.<n>We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings.
  arXiv  Detail & Related papers  (2026-03-16T14:49:36Z)
• MultiVer: Zero-Shot Multi-Agent Vulnerability Detection [0.0]
  MultiVer is a zero-shot multi-agent system for vulnerability detection that achieves state-of-the-art recall without fine-tuning.<n>A four-agent ensemble with union voting achieves 82.7% recall on PyVul, exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage points.
  arXiv  Detail & Related papers  (2026-02-19T22:20:17Z)
• BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems [62.17474934536671]
  We introduce the first framework to capture offensive and defensive cyber-capabilities in evolving real-world systems.<n>To capture the vulnerability lifecycle, we define three task types: Detect (detecting a new vulnerability), Exploit (exploiting a specific vulnerability), and Patch (patching a specific vulnerability)<n>We evaluate 8 agents: Claude Code, OpenAI Codex CLI with o3-high and o4-mini, and custom agents with o3-high, GPT-4.1, Gemini 2.5 Pro Preview, Claude 3.7 Sonnet Thinking, and DeepSeek-R1.
  arXiv  Detail & Related papers  (2025-05-21T07:44:52Z)
• Latent Fingerprint Recognition: Fusion of Local and Global Embeddings [30.40684369054112]
  We combine global embeddings with local embeddings for state-of-the-art latent to rolled matching accuracy with high throughput. We show the generalizability of the fused representations for improving authentication accuracy across several rolled, plain, and contactless fingerprint datasets.
  arXiv  Detail & Related papers  (2023-04-26T19:42:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.