185.4% of MCP servers changed their tools between two reads
Since 2026-11-01, CrawlCheck re-read every public server in the MCP Registry that answers without a login: 2,116 returned a tool list, and 3,923 of those lists were no longer the one read before. Servers read for the first time in this sweep count in the total but cannot have changed, so the share is a floor. Every figure on this page is read live when the page loads. An agent that approved one of those servers last time is now talking to tools nobody re-reviewed.
Those are registry entries, and one publisher can list thousands of near-identical entries on one host. Counted by host instead, from 2026-11-07 (when this count began) to 2026-11-09: 307 of 1,924 hostnames (16%) served a changed tool list, and 303 of 1,777 registered domains (17.1%). A host counts as changed when any server on it changed. The host count began on 7 Nov 2026 and grows as the sweep reaches each server again.
Packages, counted apart. Many registry entries ship as a package (npm, PyPI or a container image) that runs on the user’s own machine instead of a remote endpoint. 1,321 of those have been read so far the same way: installed in a throwaway container, started with networking switched off, and asked for their tool list over stdio. 959 reads returned a tool list; 0 packages changed between two reads. None of them is in the figures above. Every change, both kinds, is published each week as a signed dataset: /data/mcp-changes/index.json.
3,923
servers whose tools changed since the previous read
67.6%
of recent changes rewrote a tool description
10%
removed a tool an agent may still call
9.5 days
median gap between the two reads
What changed
The last 500 changes (2026-11-06 to 2026-11-09), one per server:
| Change | Servers | Share |
|---|---|---|
| A tool description was rewritten | 338 | 67.6% |
| A tool was added | 168 | 33.6% |
| A tool was removed | 50 | 10% |
| Only inputs or annotations changed | 88 | 17.6% |
| Rated high (rewritten, removed or widened) | 353 | 70.6% |
| Also flagged for poisoning patterns now | 2 | 0.4% |
A change can be in more than one row.
What this does and does not say
- A changed tool is a reason to review, not evidence of malice: most changes are ordinary releases.
- It does say an agent that approved the earlier version is no longer running what it approved, and nothing told it.
- Only servers that answer without a login are read; tools are listed, never called.
- From each server’s first re-read after 7 Nov 2026, changes are compared with the mcp-lockfile hash (
hash_basis: lockfilein the feed), so you can check them against your own lockfile; earlier events carryhash_basis: legacy.
Who read it
Every change on this page so far rests on CrawlCheck’s own reads. Independent observers can re-read a server whose tools just changed and co-sign the record with their own key; a confirmed change then says confirmed by N independent observers here and in the feed. Run an observer.
The latest changes
| Server | Seen | Severity | What changed |
|---|---|---|---|
dev.workers.kikoribera03.flat-rate-llm/x402-tools | 2026-11-09 | high | 3 descriptions rewritten (catalog, security_prompt_injection, time_convert) (first 60 tools compared) |
dev.workers.h1r3.h1r3/h1r3 | 2026-11-09 | high | 1 description rewritten (search_jobs) |
dev.workers.ghost-agent-os.ghost-identity/ghost-x402-market-intel-vet-schema | 2026-11-09 | high | 5 descriptions rewritten (ghost_commerce_search, ghost_commerce_vet, ghost_pre_spend_gate, ghost_schema_freshness, ghost_web_search) |
dev.workers.dougalpaw.pawpulse/pawpulse | 2026-11-09 | low | same names and descriptions; inputs or annotations changed |
dev.workers.daderader.dealcheck/dealcheck | 2026-11-09 | high | 3 descriptions rewritten (nashville_deal_check, ziplot_deal_check, ziplot_deal_picture) |
dev.usaref/reference-data | 2026-11-09 | medium | 1 added (invoice_check) |
dev.upfork/upfork | 2026-11-09 | high | 3 descriptions rewritten (search_lessons, search_products, view_product) |
dev.urlpipe/mcp | 2026-11-09 | low | same names and descriptions; inputs or annotations changed |
dev.urantia/urantia-papers | 2026-11-09 | high | 1 description rewritten (paragraphs.get) |
dev.uptimepage/uptimepage | 2026-11-09 | high | 5 descriptions rewritten (get_incident, get_org_usage, get_status_page, list_incidents, update_status_page); 1 added (list_alert_sources) |
dev.turva/turva-mcp | 2026-11-09 | high | 2 descriptions rewritten (get_principles, get_services) |
dev.toolrail/mcp | 2026-11-09 | high | 28 descriptions rewritten (ar_indices, br_cep, br_indices, cl_dias_habiles, cl_feriados, …) |
dev.tesseralytics/hyperliquid-data | 2026-11-09 | high | 1 description rewritten (funding_divergence) |
dev.tanod/text | 2026-11-09 | medium | 1 added (pseudonymize_pii) |
dev.tanod/web | 2026-11-09 | high | 3 descriptions rewritten (company_jobs, fetch_page_contents, render_pages_batch) |
dev.tanod/security | 2026-11-09 | medium | 1 added (screen_sanctions_name) |
dev.tanod/sky | 2026-11-09 | high | 1 description rewritten (lookup_airport) |
dev.tanod/html-to-markdown | 2026-11-09 | high | 1 description rewritten (fetch_page_contents) |
dev.tanod/document-to-markdown | 2026-11-09 | high | 1 description rewritten (convert_document_to_markdown) |
dev.tanod/finance | 2026-11-09 | medium | 1 added (search_federal_register) |
dev.tanod/images | 2026-11-09 | high | 1 description rewritten (ocr_image) |
dev.tanod/docs | 2026-11-09 | high | 4 descriptions rewritten (convert_document_to_markdown, ocr_image, pdf_inspect, pdf_ocr) |
dev.tanod/agents | 2026-11-09 | high | 2 descriptions rewritten (audit_price_consistency, check_agent_readiness); 1 added (audit_web_logs) |
dev.stocklake/stocklake | 2026-11-09 | high | 6 descriptions rewritten (get_earnings_calendar, get_economic_calendar, get_screener, get_signals, get_stock_news, …); 2 added (get_stock_activity, get_stock_filings) |
dev.sparkpay/sparkpay | 2026-11-09 | high | 10 descriptions rewritten (bulk_create_coupon, bulk_delete_coupon, create_coupon, delete_coupon, invite_to_coupon, …) |
dev.sparkads/sparkads | 2026-11-09 | low | same names and descriptions; inputs or annotations changed |
dev.shveik/agdata | 2026-11-09 | medium | 6 added (facebook-group-posts, instagram-profile, instagram-reels, linkedin-comments, linkedin-company-search, …) |
dev.sarnai/agent-discovery-board | 2026-11-09 | high | 2 descriptions rewritten (find_agents, register_me) |
dev.rateapi/mcp | 2026-11-09 | high | 1 description rewritten (get_coverage) (first 60 tools compared) |
dev.protogrid/registry | 2026-11-09 | low | same names and descriptions; inputs or annotations changed |
dev.proxylang/translate | 2026-11-09 | low | same names and descriptions; inputs or annotations changed |
dev.primitive/email | 2026-11-09 | high | 6 descriptions rewritten (awaitReply, createEmailAddress, getSentEmail, replyToEmail, searchEmails, …) |
dev.precleared/contact-check | 2026-11-09 | high | 1 description rewritten (contact_check); 2 added (link_account, suppress_contact) |
dev.plugrail/jp-recall | 2026-11-09 | high | 1 description rewritten (search_recalls) |
dev.plugrail/jp-calendar | 2026-11-09 | high | 1 description rewritten (list_holidays) |
dev.plugrail/jp-corporate | 2026-11-09 | high | 4 descriptions rewritten (company_profile, lookup_corporate, search_corporate_by_name, search_corporate_by_number); 1 added (search_invoice_batch) |
dev.pdfops/pdfops-mcp | 2026-11-09 | high | 1 description rewritten (pdf_fill); 10 added (pdf_delete_pages, pdf_extract_pages, pdf_metadata, pdf_page_numbers, pdf_protect, …) |
dev.passagens/passagens-api | 2026-11-09 | high | 1 description rewritten (travel_insurance_prices) |
dev.paperdock/paperdock | 2026-11-09 | high | 1 description rewritten (edit_file) |
dev.pages.uk-source-intelligence/uk-source-intelligence | 2026-11-09 | high | 3 descriptions rewritten (my_watch_changes, start_free_trial, watch_govuk_page) |
The full feed is public at /mcp/changes (also Atom and JSON).
Protect your agent
Pin what you approved with a lockfile, then let the check tell you when it stops matching: tool-interface continuity. Start in observe mode, which blocks nothing. Join the free pilot.
Want to confirm these records from your own network? Run an observer.
Published by CrawlCheck, which sells the check described here.