On 3 November, security firm Glow published research showing AI coding agents installing deprecated MCP servers that nobody patches. In 98% of the sessions it studied, the agent picked the outdated package from memory. The user never asked for it. I checked the npm registry on 5 November: 11 of the 15 official @modelcontextprotocol server packages I looked up now carry a deprecation notice. If an agent has ever set up MCP for you, one of them may be in your config. This note gives you a 10-minute audit, a rule for each server you find, and a checker that reads your config for you.
Key takeaways
- Glow found the deprecated packages downloaded more than 17.3 million times from npm since July 2025, with four high-severity flaws that will never get a patch.
- One command finds every config that uses them, and npm view <package> deprecated confirms each one in seconds.
- Switch to the service owner's server where one exists, remove the rest, and pin an exact version on everything you keep.
01What did the MCPhantom research find?
Glow reviewed transcripts of real AI coding sessions in which a deprecated MCP server was installed or suggested, and named the pattern MCPhantom. Help Net Security reported the findings on 3 November 2026:
- The agent chose the package. In 98% of those sessions the package name came from the model's training data. In 2%, the user asked for the old package by name.
- It happened everywhere. Glow saw it across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, with models from Anthropic, OpenAI and xAI. Asked to "set up a GitHub MCP", one agent installed the archived reference server instead of GitHub's own.
- Warnings did not stop it. In one session the agent checked npm, saw the deprecation notice, installed the package anyway and did not tell the user.
- The flaws stay open. Glow found four high-severity vulnerabilities in the deprecated reference servers. The worst, in the Puppeteer server, lets a prompt injection make the agent run commands an attacker chooses. The maintainers closed the report because the server is archived. No exploitation had been seen when the research was published.
The archive itself is explicit. The servers-archived repository says it is "no longer maintained" and that no security updates or bug fixes will be provided. Seven reference servers remain active in the main repository: Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time.
02Which MCP server packages are deprecated?
I queried the npm registry for each package on 5 November 2026. The registry's own deprecated field gives the answer, so you can repeat the check yourself with npm view @modelcontextprotocol/server-github deprecated. An empty reply means the package is not deprecated.
| Package | Last version | Registry status |
|---|---|---|
| server-github | 2025.4.8 | Deprecated: archived, no security guarantees |
| server-puppeteer | 2025.5.12 | Deprecated: archived, no security guarantees |
| server-postgres | 0.6.2 | Deprecated: archived, no security guarantees |
| server-gitlab · slack · redis | 2025.4.25 | Deprecated: no longer supported |
| server-gdrive | 2025.1.14 | Deprecated: no longer supported |
| server-brave-search · google-maps · everart · aws-kb-retrieval | 0.6.2 | Deprecated: no longer supported |
| server-filesystem · memory · sequential-thinking · everything | 2.1.0 to 2.2.1 | Active |
All names carry the @modelcontextprotocol/ prefix. Two archived servers ship on PyPI rather than npm and carry no deprecation flag there: mcp-server-sqlite (last release 25 April 2025) and mcp-server-sentry (last release 14 January 2025). Treat both as archived. The Git and Fetch servers on PyPI both shipped new releases on 4 November 2026.
03The 10-minute MCP server security audit
Run these in order. Each step narrows the list for the next.
- Find every config (2 minutes). MCP settings live in different files for each tool: Claude Desktop, Claude Code, Cursor, VS Code and per-project files. Search them all at once on macOS or Linux:grep -rl --include='*.json' -e '@modelcontextprotocol/server-' -e 'mcp-server-' ~ 2>/dev/nullRepeat it inside each code folder you keep outside your home directory. On Windows, run the same search in PowerShell with Select-String.
- Check each package (3 minutes). Paste each file into the checker below, or run npm view <package> deprecated for anything it does not recognise. A server with no package name, such as a local script or a url entry, needs a different question: who runs it, and when did it last ship?
- Decide each server (3 minutes). Use the rules in the next section.
- Close the door (2 minutes). Tell your agents they need approval to add an MCP server. That is a Tier 2 action under the four permission tiers for AI agents: it installs code that runs with your credentials, and it can take far more than 5 minutes to undo.
04What to do with each deprecated MCP server
| What you find | Decision | Why |
|---|---|---|
| Archived, and the service owner runs its own server | Switch to the owner's server | GitHub maintains github/github-mcp-server; its fixes ship from the people who run the API |
| Archived, not used in the last 30 days | Remove it | Unused code with open flaws is all risk and no return |
| Archived, you need it, no owner server | Fork it, pin it, own the patches | Somebody has to maintain it, and the original maintainers have stopped |
| Active, but installed with npx -y and no version | Pin an exact version | An unpinned install runs whatever the registry serves next |
| A token typed straight into the config | Move it to an environment variable | Config files get copied, synced and shared with agents |
For any browser or database server you keep, scope it down as well. Give a database server a read-only user. Put a browser server's tools at Tier 2, because a web page it reads can carry a prompt injection, which is the route the Puppeteer flaw uses.
05Worked example: a config with six servers
A hypothetical developer asked an agent to "set up GitHub, Postgres and a browser" months ago, then added a few servers by hand. The config holds six servers:
| Server | Package | Finding | Action |
|---|---|---|---|
| github | server-github | Archived · token in plain text | Switch to GitHub's server; move the token to an environment variable |
| puppeteer | server-puppeteer | Archived · open RCE route | Remove today |
| postgres | server-postgres | Archived | Replace; use a read-only database user |
| sqlite | mcp-server-sqlite | Archived | Remove; unused since the project moved to Postgres |
| filesystem | server-filesystem | Active · unpinned | Pin to @2.2.0 |
| memory | server-memory@2.1.0 | Active · pinned | Keep |
Four of six servers, 67% of the config, run code nobody patches. One more installs whatever version npm serves next. One holds a GitHub token in plain text. Only one of six passes untouched. Finding and fixing all of it took one search, six registry checks and four edits to one file.
Paste your own config below. The checker opens with this example loaded.
| Server | Package | Status | Next step |
|---|
Checks package names against the 11 npm packages marked deprecated on the registry and the 2 archived Python servers (sqlite, sentry) as of 5 November 2026, flags unpinned npx installs and secrets typed straight into the config. It runs in your browser; nothing you paste leaves the page. Delete real tokens before you paste if you prefer.
06Make MCP part of your software inventory
Glow's write-up notes why security tools miss this. Endpoint tools see a trusted Node process installing a package. Dependency scanners have no manifest to read, and the flaws carry no CVE numbers. The fix is to treat each MCP server as a dependency with an owner: one approved server per service, an exact version, a check against the registry's deprecation status before approval, and the same audit every quarter.
This is the same review I run on any software that touches credentials. In Project Aegis, I audited a desktop trading app's installer, runtime and network behaviour. An agent that installs servers on your machine needs that scrutiny too. If you want your agents' tools, permissions and MCP servers reviewed, or an agent built with those controls from day one, that is the AI agent and automation work I take on.
FAQFrequently asked questions
Which MCP servers are deprecated?
On 5 November 2026 the npm registry marked 11 official @modelcontextprotocol packages as deprecated, including server-github, server-puppeteer, server-postgres, server-slack and server-gdrive. The Python servers mcp-server-sqlite and mcp-server-sentry are archived too. Filesystem, Memory, Sequential Thinking, Everything, Git, Fetch and Time remain active.
What is MCPhantom?
MCPhantom is the name security firm Glow gave, in November 2026, to AI coding agents installing deprecated MCP servers from their training data. In 98% of the sessions it studied, the agent chose the outdated package itself. Glow found four high-severity flaws in those servers that will not be patched.
How do I check if an MCP server package is deprecated?
Run npm view followed by the package name and the word deprecated, for example npm view @modelcontextprotocol/server-github deprecated. The registry prints the deprecation notice if there is one and nothing if the package is current. For Python servers, check the last release date on PyPI and the project's repository.
What should replace the deprecated GitHub MCP server?
GitHub maintains its own MCP server in the github/github-mcp-server repository, available as a remote server or the ghcr.io/github/github-mcp-server container. Switch to it, give it a token scoped to the repositories the agent needs, and keep that token in an environment variable rather than the config file.
Sources
- Help Net Security: AI coding agents are installing MCP servers that will never be patched, 3 Nov 2026 · retrieved 5 Nov 2026
- Glow: MCPhantom, AI coding agents are installing vulnerable deprecated MCP servers from training data · retrieved 5 Nov 2026
- Model Context Protocol: servers-archived repository · retrieved 5 Nov 2026
- Model Context Protocol: servers repository (active reference servers) · retrieved 5 Nov 2026
- npm registry: @modelcontextprotocol/server-github (deprecation notice) · retrieved 5 Nov 2026
- GitHub: github-mcp-server, GitHub's official MCP server · retrieved 5 Nov 2026
Package statuses come from the npm registry and PyPI as queried on 5 November 2026 and can change. Glow's figures are as reported by Help Net Security on 3 November 2026. The developer config in the worked example is hypothetical. This is a defensive audit guide; it does not reproduce any exploit.