The State of MCP Drift: We Re-Scanned 31 Popular MCP Servers Six Months Apart
By Parth Shukla · 2026-06-30
Original research, June 2026. We re-scanned 31 popular public MCP servers six months apart using git history. Of the 1,191 tools present at both points, 20% had their description rewritten, across 61% of servers. None introduced a clear vulnerability, but a tool description is part of the prompt your agent obeys, and nobody re-reviews these changes. A point-in-time scan cannot see that the surface moved.
#mcp #mcp-security #agent-security #agent-attack-surface #tool-drift #rug-pull #aasm #state-of-mcp #prompt-injection #research
Frequently asked questions
How much do MCP server tool surfaces change over time?
In our June 2026 study of 31 popular public MCP servers scanned six months apart, 20% of the tools that existed at both points had their description rewritten, across 61% of the servers. The tool surface is edited continuously, not set once.
Is MCP tool drift a security vulnerability?
Not on its own, and not in this sample. None of the 244 description changes we found introduced a clear injectable vulnerability when checked with a static taint scanner. The risk is that the changes are silent and unreviewed, so the rare dangerous one is easy to miss, not that the changes are malicious.
Why does a changed tool description matter for security?
A tool description is part of the prompt the model reads when it decides whether and how to call the tool. When the description is rewritten, the instruction the agent follows changes. A scan run once cannot detect that change, because it has no earlier state to compare against.
How do you detect MCP tool drift?
Compare each tool's definition between two scans and flag the ones that changed in a risky direction, such as a description that gained a hidden instruction or a body that gained an exec sink. This needs memory of the previous scan. A point-in-time scanner re-rates every tool from scratch and cannot tell that anything moved.