Coding Agents Install Archived MCP Servers From Memory — 5 Commands to Audit Yours
MrDogeAlright · reddit · 2026-11-07
A new failure mode: some coding agents pull deprecated MCP server package names from training memory (Glow Labs says in 98% of such sessions the package came from the model, not the user), installing servers from the archived repo that get no security updates or bug fixes — a supply-chain risk.
Five-step audit:
- claude mcp list / codex mcp list, or open /.cursor/mcp.json
- Run npm view <package> deprecated on any modelcontextprotocol/server- you find
- Swap in the service's own official server, remove the old entry
- Read any npx -y line before accepting it
- If you can't remove one yet, deny it via mcp<server> under permissions.deny in Claude Code
Sources: Help Net Security and the modelcontextprotocol/servers-archived repo.
Related event: Coding Agents Install Deprecated MCP Servers from Training Memory(2 posts)→
More from coding & agent
- Google DeepMind's Ivan Leo to reveal how agents cheat on benchmarks at scale at AIE Code — jocarrasqueira · 2026-11-07
- Sudo mode verification revamp: passkey-first UX, inbox deep links, paste capture — JohnPhamous · 2026-11-07
- Amp teases a new way to interact with agents — vinvan · 2026-11-07
- Cryptographers flag that AI agents fail Cloudflare challenges; blind signatures may fix it — jedisct1 · 2026-11-07
- Vercel Tracing goes GA on all plans, enabled by default in Next.js 16.5 — cramforce · 2026-11-07
- Decompiling Battlefield 1942 with Claude Code costs ~$100 in API tokens — alvelda · 2026-11-07