Monitoring 2k+ MCP Servers: 7,190 Safety-Relevant Changes, Read-to-Write Flips Undetected by Allow-lists
mcpindex · reddit · 2026-08-19
mcpindex ran a crawler over public MCP servers, diffing tool contracts between daily snapshots, revealing concerning data.
Key Stats:
- 12,295 tools across 2,173 servers changed their contracts.
- 7,190 changes were "safety-relevant," altering what the tool can do, not just adding optional fields.
Risky Change Types:
- 350 tools flipped to destructive: Tools hinting as read-only now declare they can write, delete, or send. This is the "read tool quietly became a write tool" case, invisible to allow-lists.
- 279 tools added required parameters: Agents calling with last week's args now fail or use wrong defaults.
- 475 tools removed parameters Agents might still be sending.
Security Gap:
None trip auth checks; the server is still authorized with the same name. This exposes a gap in allow-lists: covering who may call a tool, but not whether it still does what it declared.
More from coding & agent
- openwiki 0.3.3 launches with built-in MCP connector and tool discovery — hwchase17 · 2026-08-19
- Puck now supports real-time voice for agent coordination — HankYeomans · 2026-08-19
- Code.Storage Opens Signups: Unlimited Git Infrastructure for AI Agents — dsp_ · 2026-08-19
- Using Directed Graphs for Predictable Agent Workflows — rseroter · 2026-08-19
- Dev vibe-codes a mobile shell over Maestro, prompts local agents from iPhone via Tailscale — cocktailpeanut · 2026-08-19
- LlamaParse Outperforms General VLMs in Document Visual Grounding — llama_index · 2026-08-19