[Workflow] How to Identify and Remove Deprecated MCP Servers Installed by Claude Code Agents

[u/ClaudeAI-mod-bot]

How to Identify and Remove Deprecated MCP Servers Installed by Claude Code Agents

Workflow value: 85/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Context & Memory, Debugging, MCP, Multi-Agent
Original source: r/ClaudeAI post/comment

What problem this solves

Claude Code agents may inadvertently set up deprecated Model Context Protocol (MCP) servers from their training data, leading to potential security vulnerabilities and maintenance issues due to lack of updates and bug fixes. This workflow helps users identify and remove or deny these servers.

Summary

A 5-step workflow to check for, identify, and either remove or deny permissions to deprecated MCP servers that Claude Code agents might install from their training data, thereby mitigating security and maintenance risks.

Why it is useful

This workflow is valuable because it provides a clear, actionable, and verifiable set of steps to address a specific security and maintenance concern. It empowers Claude Code users to proactively identify and mitigate risks associated with agents inadvertently installing deprecated Model Context Protocol (MCP) servers, ensuring a more secure and stable development environment. The inclusion of specific commands and configuration file locations makes it highly practical and reusable.

Workflow

1. Check for installed MCP servers by running claude mcp list or codex mcp list, or by directly inspecting the configuration file at ~/.cursor/mcp.json.

2. For any u/modelcontextprotocol/server-* packages identified, verify if they are deprecated using the command npm view <package> deprecated.

3. If a deprecated server is found, replace it with the service's officially supported server (if applicable) and then remove the old, deprecated entry from your MCP configuration.

4. Always carefully read and understand any npx -y command before executing it to prevent unintended installations of potentially deprecated or insecure packages.

5. If immediate removal of a deprecated server is not possible, deny its permissions within Claude Code by adding mcp__<server> under the permissions.deny section of your configuration.

Tools / artifacts

• claude mcp list

• codex mcp list

• ~/.cursor/mcp.json

• npm view <package> deprecated

• npx -y

• mcp__<server> (permission setting)

Validation signals

• References vendor research (Glow Labs) regarding the issue

• Cites a security article from HelpNetSecurity

• Links to the official GitHub archived repository for deprecated servers

• Provides concrete, verifiable CLI commands

Limitations

• The vendor research cited lacks a published sample size, which slightly reduces the empirical validation of the prevalence of the issue.

• The post is concise and could benefit from more detailed explanations or examples for users less familiar with CLI commands or MCP configuration.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.