The tools your agent trusted yesterday may not be the tools it gets today.
We connected to every server in the official MCP registry that we could run without an account, recorded its tool definitions, and did it again a day later. Most of what we found isn't poisoning. It's change: remote servers rewrite what their tools say and do, usually without publishing a new version.
- 49,147 servers listed
- 418,865 tool definitions scanned
- 6% of remote servers changed in a day
- 4 real poisoning cases
840 remote servers changed their tools in 23.5 hours.
Of the 14,032 remote servers that answered both times, 840 returned different tool definitions the second time. 708 of them (84%) still listed the same version in the registry, so nothing outside the server itself said anything had changed.
Packages from npm or PyPI are pinned to a version, and when they change they almost always ship a new one. A remote server is whatever is running at that URL right now.
What changed, by server
We read the flagged changes from our first day by hand, and none looked malicious. They were ordinary product updates. That is the point: an agent can't tell an ordinary update from a bad one unless something remembers what the tool said before. A few servers also put per-request values in their definitions, so they look changed on every visit.
Poisoning was rare. False alarms weren't.
We ran Toolport's own tool-poisoning scanner over 418,865 definitions from 25,486 servers. On the first pass it flagged 212 distinct cases. We read every one. 4 were real, from 3 publishers, and all 4 were vendors' own risky instructions: telling the agent to pipe a remote script into a shell, or to save something without telling the user. We found no hidden attack.
The rest were false alarms: Persian text, which joins letters with invisible characters; the IEX stock exchange matching a
PowerShell command; lists like javascript | python; and notes like "do not tell the user a refund is coming",
which are about accuracy, not secrecy. Those would have fired for Toolport users too, so we
fixed the scanner. On the same definitions, flags fell from 511 to 299,
nothing new was flagged and all 4 real cases still are. Most of what is left is security tools that quote
attack phrases as examples. We left those alone, because loosening that rule would make the scanner easy to dodge.
Half the registry answers without setup.
The latest state of each of the 49,147 servers listed on 2026-10-24.
- Answered with a tool list25,12651%
- Needs a login or API key9,31519%
- Needs configuration first4,93110%
- Failed or did not answer7,94316%
- Nothing we could run1,8324%
Most logins are HTTP 401 (8,422). Most configuration is a required environment variable (3,773). Of the failures, 2,575 servers exited at startup, 1,794 rate-limited us, 771 returned 404 and 466 had no DNS record. Almost half of the servers we couldn't run are desktop bundles (898).
How we did it
- We read the official registry at
registry.modelcontextprotocol.ioand probed each server as a fresh MCP client, with no account and no API keys. - Remote servers were asked for their tools over HTTP. npm and PyPI packages were installed in a locked-down container with install scripts off, then started with no network, no host files and no credentials.
- Every remote server was probed on each run, and about a seventh of packages each day. The change numbers compare the runs at 04:03 UTC on 2026-10-23 and 03:36 UTC on 2026-10-24, and count only servers that answered both times.
- A change means any difference in a tool's name, description, input or output schema, or annotations. We compared definitions with the same fingerprints Toolport uses to pin tools.
- One day is a short window. We'll repeat this, and the numbers will move.
- We don't name servers here. Flagged servers are reviewed privately, and their authors hear from us before anything about them is public.
Pin what your agent trusts.
Toolport fingerprints every tool when a server connects and flags any later change, so a rewritten description or a new delete tool doesn't slip in quietly. By default it asks before a destructive tool runs.