last deploy · 2026.09.15 · d808e30
Agent tool registries are argued about far more than they are measured. I publish open, citable baselines for the Model Context Protocol ecosystem: what tools claim, whether those claims hold, and whether the code behind them still exists. Every dataset below is CC-BY and built from the same pipeline that runs mcpindex.ai in production, so the numbers are operational exhaust rather than a one-off crawl.
AI Context San Jose
An agent vets a tool once, at install. The contract is served live by someone else's process, and MCP's change notification is optional, so a server can rewrite what a tool claims to do without telling anyone. The session covers the threat model including the adversary who never sends the notification, the pattern that catches it, and a live demo where a pinned contract drifts mid-session and the call stops. It also covers where the method runs out: a stale declaration can still be accurate, so this is a change tripwire rather than a safety oracle.
Measures how many MCP tools declare the effects a policy gate would need, and whether those declarations stay bound to the contract actually observed. Ships a fixture generator and an aggregate verifier, so every number regenerates from the released files alone.
Publishes the longitudinal observation panel behind the drift measurement, so the result can be reproduced and extended rather than taken on faith.
A two-vantage census of the GitHub repositories behind registry-listed MCP servers: 1,830 of 13,105 repos (14.0%) were no longer publicly accessible as of 2026-07-20, affecting 2,069 listed servers that registries keep serving.
Aggregate and per-server records of safety-relevant contract changes across the reachable remote-server population: tools appearing, disappearing, and quietly changing their descriptions after publication.
Description drift is not spread evenly across a registry, so re-auditing the servers that drifted before leaves most of the next window's drift unseen. Reports the coverage a drift-ranked re-audit actually achieves against the panel it is drawn from.
Across 44,172 tools on 2,043 servers of the public MCP registry, 83.8% declare at least one canonical effect annotation and 59.3% hold a declaration still bound to an unmutated contract, a binding gap of 24.5 percentage points. All four annotation defaults are restrictive, so 86.0% of first declarations move a tool from assumed-restricted to declared-permissive with no change event for a watcher to fire on.
Contributor. Argued in the open that the framework's dependency guidance covered code taken into a build and said nothing about services called across a trust boundary; the project lead rewrote and consolidated the section around it, and two further commits are merged into the framework document.
Submitted a mitigation for Publish Poisoned AI Agent Tool covering contract mutation after a tool has been approved, which the technique did not previously cover. Under review.
Real-data conformance fixtures for the action-class and reversibility controls, built from observed MCP tool contracts rather than authored examples.
Contributor. Authored Pattern 8 on tool-contract capture and drift verification for agentic and MCP integrations; the drift and source-liveness datasets are cited in the current draft.
Contributor. Defined the data schema and validation tooling for the agent tool-exchange trace dataset - a JSON Schema, a validator covering the span graph, provenance and secret scanning, and a CI workflow that runs it on every change - merged 2026-09-15.