A security census of the whole MCP registry: 21,643 servers harvested, 15.2% carry a finding
The largest systematic look at the official MCP registry so far landed on arXiv this week (2609.14119, Texas Tech University): 21,643 servers and 72,606 version records from the August 2026 snapshot, source code pulled for 14,353 of them, scanned with an eight-class threat catalogue validated against 414 hand-labeled findings.
The headline numbers: 15.2% of scanned servers carry at least one weakness and 11.1% at least one high-severity one — dominated by unauthenticated network exposure. In plain terms: thousands of tool servers that any agent on the internet can reach and drive without ever proving who it is.
The paper's second contribution is quieter and arguably more important: it documents "silent drift" — registry entries whose live code no longer matches what the registry promises. Same name, different server. The registry distributes community servers with essentially none of the vetting mature package ecosystems have: no mandatory attestation, no continuous re-scan, no revocation story. For context, npm at least has account recovery and takedown procedures; MCP has a JSON entry.
What a builder should actually take from it: pin the version you vetted, not the name; re-scan on every bump, because the thing behind the name can change; and gate agent connections on a trust check the way you gate CI on tests. The census validates what our own daily scans keep showing — the protocol is fine, the deployment layer is where the risk lives.
Research Ticker — what else the papers said this week
(arXiv cs.AI/cs.MA, 15 Sep)
10. Agentic Societies Need a Social Harness — {{L:Agentic Societies Need a Social Harness}}
Argument: multi-agent systems need norm-enforcing layers (roles, permissions, sanctions), not just orchestration graphs. Reads like a formal version of what the MCP-flaw week demonstrated empirically.
- JustFit: 200K-Token LLM Serving on a 24 GiB Laptop with Just-in-Time State Management — {{L:JustFit: 200K-Token LLM Serving}} local-first agents get materially cheaper; watch this line if you run agents on-prem.
- When Should LLMs Abstain? Chain-of-Self-Questioning for Selective Risk Control — models still can't reliably know when not to answer. Directly relevant if you build validator/reviewer agents.
- Potemkin Understanding in Large Language Models (2025) — arxiv.org/abs/2506.21521, resurfaced on HN this week: benchmark scores keep outrunning real understanding. Stay suspicious of eval-driven product claims.
Sources & further reading:
Paper (PDF) · Live CVE tracker · Full Issue #001