When you add an MCP server to an agent, you choose it by name. The name is what you read, what your colleague recommended and what your security team approved. The code your agent actually runs is whatever that name points at today.
We call it a listing swap when that changes underneath the name: the current version of a server in the official MCP registry reaches a different remote-endpoint domain, or a different package owner, than the first version published under the same name.
1,075 servers in the official MCP registry now point at a different domain or package owner than when they were first published. 698 of them kept exactly the same title and description.
What we measured
On 10 October 2026 we downloaded every entry in the official registry (142,002 versions of 41,351 servers) and compared each server's current version with the first one published under its name. We counted a swap only when the owner changed, not when a server simply moved to a new path, version or subdomain.
| Measure | Servers |
|---|---|
| Servers in the registry | 41,351 |
| Servers with more than one version | 17,989 |
| Listing swaps | 1,075 (6.0% of servers with history) |
| Package now published by a different owner | 652 |
| Remote endpoint moved to a different domain | 377 |
| Switched between a local package and a remote endpoint | 47 |
| Swapped with the same title and description | 698 (65%) |
Why it matters
We are not saying these servers are malicious. Most swaps are probably ordinary: a project rebranded, moved its hosting, or handed its package to a new maintainer. The problem is that a takeover looks exactly the same, and today nobody would notice either one.
- The registry checks the name, not the target. Publishing under a namespace proves you control the namespace. Nothing compares where version 2 points with where version 1 pointed.
- Clients trust the name. Installing from a registry resolves the name to its latest version. An approval given once is not asked again when the endpoint or package owner changes.
- The listing looks the same. In two thirds of swaps the title and description did not change, so a person reviewing the listing sees nothing new.
This sits one level above the tool-definition “rug pull” Invariant Labs described in 2025, where a server changes its tool descriptions after you approve them. A listing swap does not need the server to change anything about itself: the name now leads to different code, run by someone else.
A harmless example
Picture a weather server, io.example/weather, published with a package from the @example npm scope. Your team approves it. A month later version 1.3 is published under the same name, with the same description, but the package now comes from a different scope run by a different person. Your agent picks up 1.3 on its next install. Nothing in your client tells you that the publisher of the code changed, and if the new package reads files or sends data somewhere new, it does so with the permissions you granted to the old one.
What to do about it
If you install MCP servers
- Pin a version, and where the registry offers it, a package hash or image digest.
- Treat a change of endpoint domain or package owner as a new server, and review it again.
- Check before you install. Ask ChatGPT or Claude with the Redthread connector, “check whether this MCP server passed Redthread's scan”, or verify a badge with the open-source
atpp verify. - Check what you already have installed:
python3 atpp.py check-configreads your Claude, Cursor or VS Code config on your machine and flags any server whose listing has swapped (how).
If you publish one
- If you move hosting or hand over a package, say so in the listing and in your repository, so users have a reason to trust the new target.
- Publish package hashes and pin images by digest; a signed artifact gives users something to compare.
If you run a registry or a client
- Show the target next to the name, and show what changed between versions.
- Ask again when a server's endpoint domain or package owner changes, the way a phone asks again when an app wants a new permission.
The check is free
From today, Redthread's daily scan of the registry includes a target-stable check. Every server's signed scan result and badge now says whether its listing has swapped since it was first published, and the counts are updated every day on the registry scan page. The same check is available inside ChatGPT and Claude through the Redthread connector.
If your team runs agents that install third-party MCP servers and you want an allow-list that alerts you when an approved server swaps, talk to us.