I re-ran 152 versions of popular MCP servers. Nearly half the updates changed what the tools tell your agent.

Описание и применение

В исследовании 152 обновлений популярных серверов MCP было обнаружено, что 47 % изменяют поверхность инструментов, в основном переписывая описания параметров. Автоматический инструмент mcpgawk позволяет обнаруживать и блокировать такие изменения, обеспечивая безопасность агента.

Задача

MCP servers are approved once, but unpinned npm packages update silently, changing tool surfaces without re‑approval, potentially altering agent behavior.

Результат

In a study of 152 stable MCP server releases, 47% changed the tool surface; 48% in an independent replication. Most changes were rewritten parameter descriptions (92 instances). The mcpgawk tool automates detection and enforcement of such changes.

Рабочий процесс

• 1. Pin MCP server versions in configuration to avoid automatic updates.
• 2. Snapshot the tool list (names, descriptions, schemas) upon approval.
• 3. On each launch, diff the current tool list against the snapshot, including descriptions and schemas.
• 4. If differences are found, refuse to call altered tools until the user explicitly approves the change.
• 5. Optionally probe servers without API keys to detect key‑protected tool changes.

Доказательства

I took the 30 most-downloaded MCP server packages on npm. For each one I pulled every stable version published between March and September 2026 (up to 12 per package), and launched each version the same way:

Источник

Updates that changed the tool surface 40 (47%)

Источник

An independent researcher, using her own setup on nine servers, measured 48% across 96 releases. Two methods, two machines, the same answer: roughly every second update changes what your agent is told.

Источник

Tools added / removed: 12 / 4

Источник

Parameter descriptions rewritten: 92 — the biggest category by far

Источник

I built mcpgawk: it records what every tool said when you approved it, and if a tool rewrites its description or gains power afterwards, the call is refused before it runs — until you decide.

Источник