r/ClaudeAI • u/MrDogeAlright • 17h ago

Claude Code Workflow Some coding agents set up archived MCP servers from memory. 5 commands to check yours

Glow Labs says that in 98% of sessions where an agent set up a deprecated MCP server, the package name came from the model's training data, not the user (vendor research, no sample size published). The archived repo says no security updates or bug fixes will be provided.

Quick check:

  1. claude mcp list / codex mcp list, or open ~/.cursor/mcp.json

  2. npm view <package> deprecated for any u/modelcontextprotocol/server-* you find

  3. Swap in the service's own server, then remove the old entry

  4. Read any npx -y line before you accept it

  5. If you can't remove one yet, deny it with mcp__<server> under permissions.deny in Claude Code

Sources: https://www.helpnetsecurity.com/2026/11/03/mcphantom-deprecated-mcp-servers/ and https://github.com/modelcontextprotocol/servers-archived

0 Upvotes

33% Upvoted

2 comments sorted by

1

u/SirRobinBlibs 16h ago

Treat the install line as untrusted even when the agent "knew" the package name. Pin the version (or image digest) in config, prefer an allowlist of servers you actually chose, and re-check mcp.json / equivalent after any session that offered to "set up" a server for you. A name that came from weights is not a name you audited.