MCP
10 articles
-
MCPCoding Agents Still Install an MCP Server Archived in 2025
Glow Security's MCPhantom research (2 Nov 2026) says coding agents name archived MCP reference servers from model memory, not from a lookup; in 98% of the deprecated installs it reviewed the user had not asked for that package by name. Verified hands-on: ten headless Claude Code runs (Haiku 5.5 and Sonnet 5.5) plus a Codex run, each asked to write the MCP config for a GitHub, Postgres, Slack, browser and Brave server. Both models named the archived @modelcontextprotocol/server-postgres for Postgres; Sonnet also returned archived server-github, server-slack and server-brave-search; Haiku returned GitHub's hosted remote and Brave's own @brave/brave-search-mcp-server; Sonnet returned @playwright/mcp for the browser; Codex pointed at github/github-mcp-server. All the reference servers are deprecated on npm and live in modelcontextprotocol/servers-archived (archived, last push 2025-05-28, README states NO SECURITY GUARANTEES). This morning the npm deprecation text on the GitHub, Postgres and Puppeteer packages was rewritten from the generic contact-npm-support boilerplate to Archived and unmaintained; no security guarantees when issue #4785 was closed at 04:21 UTC; npx prints it and installs anyway.
-
Claude CodeClaude Code Replaced Broken Configs With a 258-Byte Default
Claude Code 2.1.317, started headless (claude -p, or a subcommand such as claude mcp list), copies an unparseable ~/.claude.json to backups/, writes a 258-byte six-key default in its place and exits 1; the next start runs on the default with no MCP servers and no trusted folders and says nothing. Hands-on in a throwaway CLAUDE_CONFIG_DIR: a /* comment */, a file cut at 60%, an empty file, and an empty file with backups present all reset the same way; claude --version left the file alone; an interactive start under a pseudo-terminal showed the two-option dialog and left it alone; the restore hint named a planted empty newest backup; a backup of the broken file is written 7 ms after the .corrupted copy. On this Mac the file is 619 KB, 124 keys, 221 project entries (160 trusted), 8 user-scope MCP servers; five backups spanning ten hours. 12 parallel claude mcp add landed 12/12; four batches of 40 landed 159/160 with all 160 exiting 0 (srv35 printed Added and was missing). Timeline: 1.0.31 (20 June 2025) fixed the same reset; issues 69354 (18 June 2026, 2.1.142), 73590 (2 July, Windows, 45 .corrupted files) and 87551 (18 August, reproduced by claude[bot] on 2.1.234 within 32 minutes, labels data-loss + reproduced, closed stale by github-actions 20 September). 2.1.318 (npm 2026-11-03 21:55 UTC) cites #87551 and says the start now fails and leaves the file; six changelog lines about the file in total. 2.1.318 not run: auto-updater had not fetched it, the sandboxed session refused a direct download.
-
Claude CodeClaude Code's Sandbox Ran Your Shell Config Outside It
On Wednesday 22 October Claude Code 2.1.309 fixed sandboxed Bash commands running the shell's startup files outside the sandbox before each command. On 2.1.308 every sandboxed command started as an unsandboxed /bin/zsh -c that sourced ~/.zshenv with full access in the project directory, so a .env a sandboxed command wrote was executed with full access on the next Bash call; verified on macOS with an instrumented ZDOTDIR, canary file in the home directory on 2.1.308, denied on 2.1.309 and 2.1.310. The same release stopped sandboxed commands editing the file passed with --mcp-config (appendable on 2.1.308, operation not permitted on 2.1.310). Monday's 2.1.305 added sandbox.allowNestedUserNamespaces, which the docs say turns off a security boundary, and Thursday's 2.1.310 fixed Windows PreToolUse and PermissionRequest hooks letting calls through when Git Bash is missing. The per-session shell snapshot still runs your login shell outside the sandbox at a session's first Bash command, with the project as its working directory, so a leftover .env still runs there on 2.1.310.
-
AgentsAnthropic's Lab Hardware Standard Brings Back the Manifest
Anthropic opened the research preview of the Model Hardware Standard on 27 August, letting agents drive microscopes, liquid handlers and the lasers inside a quantum computer. The MHS driver auto-generates a per-device file listing capabilities and safety limits, enforced at the device rather than requested of the model. That is a static, inspectable manifest, the exact artifact that has been dissolving on the software side of the agent stack all year.
-
AgentsSalesforce Put Its Whole API Behind Four MCP Tools
Claudeforce launched on 26 August, and Salesforce in Claude runs on the Headless 360 MCP server, which puts the entire Salesforce API behind four tools. One of them is Dispatch, a universal verb resolved at runtime by semantic search. The context economics are right and the tool list stops being a review artifact, which moves the whole access question onto the permission set of whoever authorised the connection.
-
MCPMCP Went Stateless, and the Sticky Session Was the Whole Problem
The 2026-07-28 MCP release candidate makes the protocol stateless, no handshake and no session id, so any request can hit any server instance. That deletes the sticky routing and shared session store most remote MCP servers were built around and lets them run behind a plain load balancer.
-
AgentsThe Tool Call Now Returns a Ticket, Not a Result
MCP's release candidate makes Tasks a first-class extension: a tool call can hand back a handle instead of an answer, because agent work stopped fitting inside one request. Here is what changes if you build MCP servers.
-
MCPMCP Went Stateless. Your State Didn't Disappear, It Moved.
The July 28 MCP spec removes the protocol session, so any request can hit any server instance and a remote MCP server can finally run behind a plain load balancer. The catch: the state you kept in the session does not vanish, it moves into opaque handles you have to design yourself.
-
AgentsThree MCP Servers, 72 Percent of the Context Gone
Every tool an MCP server exposes loads its full definition into the agent's context at the start of the conversation, used or not. One team measured three servers eating 143,000 of 200,000 tokens before the agent read a single instruction, and a benchmark found MCP costing 4 to 32 times more tokens than a CLI for identical work. Use MCP for discovery, dispatch to a CLI for execution.
-
SecurityMCP Gave AI Agents Superpowers. Attackers Noticed.
The protocol that lets AI agents use tools also gave attackers a new attack surface. January 2026 showed us how bad it can get.