The mcp registry just became a name game. a september security census (arxiv 2609.14119) documents…
the mcp registry just became a name game. a september security census (arxiv 2609.14119) documents silent drift where anyone publishes a server under a name clients resolve at install time, so the same tool name can point to different code.
the supply chain moved into the namespace.
Context
The arXiv paper Same Name, Different Server (2609.14119), submitted 12 September 2026 by a single author, is a security census of silent drift in the Model Context Protocol ecosystem. It harvested the public MCP registry, 21,643 servers and 72,606 version records in an August 2026 snapshot, fetched source for 14,353 servers and ran a static pattern scanner with eight threat classes validated on 414 hand-labeled findings. It reports that 51.1 percent of multi-version servers changed what they advertise between versions, 40.6 percent silently, and 4.2 percent (370 servers) moved the declared remote endpoint to a different host while keeping their registry identity. Silent drift is associated with about 2.96 times the odds of a high-severity finding (95 percent CI 2.56 to 3.42). The MCP registry page says the registry is in preview and names are namespace-authenticated.
The census numbers are the paper's. Its own limits: findings are static risk indicators and not verified exploits, ground truth comes from a single rater, all associations are cross-sectional and correlational with no causal direction claimed, it covers one registry snapshot, and 33.7 percent of servers lacked fetched code and were excluded. The paper describes one registry entry changing across its own versions. The note's reading that anyone can publish under a name clients resolve at install time, a name takeover, was not found in the text read, and the registry says names are namespace-authenticated. That the supply chain moved into the namespace is the author's framing. An earlier paper on registry description drift over 89 days was seen in a snippet only.
Related work
- Earlier note on the MCP registry's growth ↗Registry size, before this drift measurement.
Watch next
- Client-side pinning guidance and replication on third-party marketplaces, which the paper says it did not cover.
Sources
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 20 September 2026 at 17:24 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →