同名不同服务器：模型上下文协议生态系统中静默漂移的安全普查
Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem
- Texas Tech University（德克萨斯理工大学）
- College of Media and Communication（媒体与传播学院）
机构由 AI 辅助整理，请以论文原文为准。
中文总结 AI 辅助
本文普查MCP生态系统，发现静默漂移普遍（51.1%多版本服务器变更宣传），与高严重性风险显著相关（OR=2.96），并提出注册表设计、客户端固定等安全建议。
中文摘要 AI 辅助
模型上下文协议（MCP）已成为大型语言模型应用访问外部工具的通用接口，其公共注册表现在分发了数千个社区构建的服务器，而成熟软件包生态系统所积累的审查基础设施却寥寥无几。本文对该生态系统进行了普查。我们抓取了完整的公共MCP注册表（2026年8月快照，包含21,643个服务器、72,606条版本记录），获取了14,353个服务器的源代码，并应用了一个基于模式的扫描器，该扫描器覆盖八类威胁目录，其准确性通过414个手工标注的发现进行了衡量。观察到的普遍性以未经认证的网络暴露为主（占扫描服务器的9.57%）；在按实测精度对每类进行校正后，观察到的高严重性普遍性从11.14%降至约7.6%。核心发现涉及不稳定性而非任何单一弱点：51.1%的多版本服务器在不同版本间改变了其宣传内容，40.6%的服务器静默地进行了更改，4.2%的服务器在保持注册表身份的同时将其远程端点重定向到不同主机，而协议从未向已安装的客户端揭示这一变化。静默漂移与高严重性发现的几率增加近三倍相关（OR = 2.96，95% CI [2.56, 3.42]）。流行度仅提供微弱的保护（每单位对数星级的OR = 0.78），因此星级计数是安全性的不佳代理。我们为注册表设计、客户端固定和扫描器分类提出了具体建议，并发布了一个匿名化工件。
英文摘要
The Model Context Protocol (MCP) has become the common interface through which large language model applications reach external tools, and its public registry now distributes thousands of community-built servers with little of the vetting infrastructure that mature package ecosystems have accumulated. This paper reports a census of that ecosystem. We harvested the full public MCP registry (21,643 servers, 72,606 version records, August 2026 snapshot), fetched source code for 14,353 servers, and applied a pattern-based scanner covering an eight-class threat catalogue whose accuracy we measured against 414 hand-labeled findings. Observed prevalence is dominated by unauthenticated network exposure (9.57% of scanned servers); after correcting each class by its measured precision, 11.14% observed high-severity prevalence reduces to roughly 7.6%. The central finding concerns instability rather than any single weakness: 51.1% of multi-version servers changed what they advertise between versions, 40.6% did so silently, and 4.2% redirected their remote endpoint to a different host while keeping their registry identity, a change the protocol never surfaces to installed clients. Silent drift is associated with nearly threefold higher odds of a high-severity finding (OR = 2.96, 95% CI [2.56, 3.42]). Popularity offers only weak protection (OR = 0.78 per unit of log stars), so star counts are a poor proxy for safety. We derive concrete recommendations for registry design, client-side pinning, and scanner triage, and release an anonymized artifact.
