How many MCP servers change their tools after you connect them? We read 118 servers twice

When your agent connects an MCP server, the server hands it a list of tools and, often, a block of instructions. Your agent reads that text to decide what to do. The server can change it whenever it likes, and there is no version number to compare against. So we measured how often it actually changes.

What we did

The official MCP registry lists more than 30,000 remote servers. We read the tools of a set of them on 30 October 2026, recorded a fingerprint of each server's tool names, descriptions, schemas and instructions, then read the same servers again about three days later and compared the fingerprints. We never called a tool.

What changed

Of 118 servers we read both times, 18 had changed. In those 18: 4 added a tool, 15 edited an existing tool, 9 changed their instructions, and none removed a tool. A server can do more than one of these, so the counts overlap. A control of 128 servers read twice back to back showed 0 changes, so the comparison itself is steady: when a fingerprint moves, the server moved, not our reading of it.

That is about one server in seven changing what it offers inside three days. The tool text and the instructions are the exact channel a poisoned server uses to steer an agent, which is why a change there is worth noticing even when most changes are ordinary.

What this does not say

Read it narrowly. The sample is small and not random: it is the first readable servers in registry order, which skews to new .ai names. We compared hashes, so we know a server changed, not what changed or why. Some of those changes are surely a date, a count or a word in a description. And a change is not an attack. Most are a team shipping an update. The finding is only that servers move, and that nothing tells you when one you approved last week offers something different this week.

What we do with it

We re-read every server in the registry about every two weeks and record when its tools change after the first time we read it. That record is what turns "servers change" into "this server changed, on this date".

Check a server yourself

Paste any remote server's URL into the free MCP server check. It reads the tools the way this survey did and names any rule that fired, without quoting the flagged text. A clean read means these rules found nothing today. A server can change after that.