Do MCP servers change their tools?
Often. We installed the newest releases of 46 popular MCP servers and recorded every tool definition each one served. Of the 34 that started, 28 added, removed or rewrote a tool, in 61 of 128 updates. Your agent reads that text as instructions, and a version range lets it change without anyone looking.
Recorded on 24 October 2026 on a clean machine with placeholder settings; nothing was called, only tools/list. A changed description is not a vulnerability: we found no malicious change. Method and limits.
| Server | Updates that changed a tool | Descriptions rewritten | Last change |
|---|---|---|---|
| mcp-atlassian PyPI | 5 of 5 | 57 | 0.23.0 → 0.23.1 |
| @perplexity-ai/mcp-server npm | 4 of 5 | 6 | 1.2.1 → 1.3.0 |
| chrome-devtools-mcp npm | 4 of 4 | 6 | 1.11.0 → 1.12.0 |
| @playwright/mcp npm | 4 of 5 | 0 | 0.0.82 → 0.0.83 |
| @wonderwhy-er/desktop-commander npm | 3 of 5 | 17 | 0.2.52 → 0.3.0 |
| @supabase/mcp-server-supabase npm | 3 of 5 | 7 | 0.13.0 → 0.14.0 |
| @sentry/mcp-server npm | 3 of 5 | 5 | 0.39.0 → 0.40.0 |
| exa-mcp-server npm | 3 of 5 | 4 | 3.2.1 → 3.4.0 |
| @hubspot/mcp-server npm | 3 of 5 | 1 | 0.3.3 → 0.4.0 |
| firecrawl-mcp npm | 2 of 5 | 5 | 3.33.4 → 3.34.0 |
| arxiv-mcp-server PyPI | 2 of 5 | 3 | 0.7.2 → 0.7.3 |
| awslabs.aws-documentation-mcp-server PyPI | 2 of 5 | 2 | 1.2.1 → 1.2.2 |
| mcp-server-git PyPI | 2 of 2 | 1 | 2026.10.10 → 2026.10.19 |
| tavily-mcp npm | 2 of 5 | 1 | 0.2.18 → 0.2.19 |
| @brave/brave-search-mcp-server npm | 2 of 5 | 0 | 2.1.3 → 2.1.4 |
| @executeautomation/playwright-mcp-server npm | 2 of 5 | 0 | 1.0.10 → 1.0.11 |
| airtable-mcp-server npm | 2 of 5 | 0 | 1.13.0 → 1.14.0 |
| mcp-server-fetch PyPI | 2 of 2 | 0 | 2026.10.10 → 2026.10.19 |
| mongodb-mcp-server npm | 2 of 5 | 0 | 2.1.2 → 3.0.5 |
| @modelcontextprotocol/server-everything npm | 1 of 1 | 3 | 1.0.0 → 2.0.0 |
| duckduckgo-mcp-server PyPI | 1 of 1 | 1 | 0.6.1 → 0.7.0 |
| @modelcontextprotocol/server-memory npm | 1 of 1 | 0 | 1.0.0 → 2.0.0 |
| @modelcontextprotocol/server-sequential-thinking npm | 1 of 1 | 0 | 1.0.0 → 2.0.0 |
| @upstash/context7-mcp npm | 1 of 5 | 0 | 4.3.0 → 4.4.0 |
| figma-developer-mcp npm | 1 of 5 | 0 | 0.11.0 → 0.12.0 |
| mcp-server-qdrant PyPI | 1 of 1 | 0 | 0.8.0 → 0.8.1 |
| mcp-server-time PyPI | 1 of 2 | 0 | 2026.10.10 → 2026.10.19 |
| task-master-ai npm | 1 of 5 | 0 | 0.42.0 → 0.43.0 |
| @agentdeskai/browser-tools-mcp npm | 0 of 2 | 0 | none seen |
| @apify/actors-mcp-server npm | 0 of 4 | 0 | none seen |
| @heroku/mcp-server npm | 0 of 1 | 0 | none seen |
| @modelcontextprotocol/server-filesystem npm | 0 of 1 | 0 | none seen |
| @notionhq/notion-mcp-server npm | 0 of 5 | 0 | none seen |
| mcp-server-kubernetes npm | 0 of 5 | 0 | none seen |
Did not start
These needed a real key or a running service, or had no current release, so there is nothing to compare: @modelcontextprotocol/server-brave-search, @browserbasehq/mcp-server-browserbase, @elastic/mcp-server-elasticsearch, @modelcontextprotocol/server-github, @modelcontextprotocol/server-gitlab, @modelcontextprotocol/server-google-maps, @21st-dev/magic, markitdown-mcp, @modelcontextprotocol/server-postgres, @modelcontextprotocol/server-puppeteer, @modelcontextprotocol/server-slack, mcp-server-sqlite.
Know when yours change
verfy lock check --update pins the tools your MCP config serves today in verfy.lock. Commit it, and the CI check fails the pull request when a tool changes, with the text before and after.