Auditing 69 MCP Servers Reveals 73 Drifts
manifest-drift · reddit · 2026-07-15
The author audited 69 MCP servers in their stack and found 73 undeclared behaviors across 11 servers. The most common issues were tools lacking declarations for internet access, file writing, spawning subprocesses, or reading environment variables, despite static analysis revealing these capabilities.
Key stats:
- 73 distinct undeclared behavior patterns
- 48 instances of undeclared network capabilities, making up 66% of all findings
- 13 instances of undeclared file writes
- 9 instances of undeclared subprocess spawning
- 3 instances of undeclared environment variable reads
Ironically, the worst offender wasn't a business tool, but the auditing tool itself: 46 issues originated from it, mainly because dependency chains brought network-related code paths along. The author emphasizes this doesn't necessarily indicate malice, but rather typical "drift": an AI agent added convenient calls while modifying a tool, but the manifest wasn't updated.
The article concludes:
- Undeclared doesn't mean malicious, but it does mean unauditable.
- Network capabilities are the primary source of drift.
- Auditors must also be audited.
- Static analysis is conservative; these numbers are closer to an upper bound rather than measured traffic.
More from coding & agent
- Dev builds talk on guardrails workflow for shipping AI-written code without reading it — TejasKumar_ · 2026-09-11
- banteg: Codex auto-review has regressed, blocking steps needed to complete authorized tasks — banteg · 2026-09-11
- A doc-anchored agent workflow: you write, the agent only critiques and finds disagreements — lucasmeijer · 2026-09-11
- SymKit MCP: 44 tools for AI agents to verify symbolic derivations — Foreign-Specific-604 · 2026-09-11
- GitHub Copilot team routes user bug reports to an AI agent via Slack — marlene_zw · 2026-09-11
- Scanning 23 agent sessions, a dev found 3 silent failure modes in memory systems — No_Advertising2536 · 2026-09-11