Your coding agent may be installing MCP servers nobody maintains

Ask a coding agent to “connect to GitHub” or “add a Postgres tool”, and it will often reach for an MCP server it remembers. The problem is what it remembers. Research published this week by the security company Glow Labs shows agents installing the old Model Context Protocol reference servers, packages that have been archived and will not get security fixes, because those are the names in their training data.

Glow calls the pattern MCPhantom. It is a quiet problem, and a cheap one to fix once you know to look.

What the research found

Glow reviewed real coding sessions. In 98% of the sessions where an agent installed or suggested a deprecated server, the package name came from the model itself; in the other 2%, the user had asked for the old package by name. It saw the pattern in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, across models from Anthropic, OpenAI and xAI. So this is not one vendor's bug. It is how models with a training cutoff behave.

The packages are the original @modelcontextprotocol reference servers for GitHub, Postgres, Slack, Puppeteer, Brave Search, Google Maps, GitLab, Google Drive, Redis and a few others. Together they have been downloaded more than 17.3 million times from npm since July 2025, and Help Net Security reports that five of them still sit in npm's top 100 MCP packages. In one session, the agent passed over GitHub's own MCP server and installed the archived reference server instead.

Glow reports four high-severity vulnerabilities in these servers. The one it describes in detail is in the Puppeteer server: with a prompt injection, an attacker can make the agent start any process instead of the browser. The maintainers closed the report because the code is archived, writing that the server “is unmaintained, so no fix or release will come from this repository.” Glow says it has seen no exploitation yet.

“The model's memory is now a package manager with no deprecation feed.” Ophir Arie, co-founder of Glow Labs

Why your usual tools miss it

An MCP server configured for an agent usually lives in a small JSON or TOML file in the project or the home directory, not in package.json. So dependency scanners never see it. The flaws have no CVEs, so vulnerability feeds stay quiet. To endpoint security, it looks like a developer installing a public npm package.

Even checking the registry is not enough. Glow describes one agent that looked the package up on npm, saw the deprecation notice, and, in Glow's words, “installed the package anyway and never told the user.”

Check your team's machines

Find the configs. The common places are .mcp.json in a repository and ~/.claude.json for Claude Code, .cursor/mcp.json and ~/.cursor/mcp.json for Cursor, and ~/.codex/config.toml for Codex CLI. Your agents may use others.

Search for the archived servers. Some @modelcontextprotocol servers are still maintained, so look for the specific archived names rather than the whole scope:

grep -rnoE "@modelcontextprotocol/server-(github|gitlab|postgres|slack|puppeteer|brave-search|google-maps|gdrive|redis|aws-kb-retrieval|everart)" \
  ~/.claude.json ~/.cursor/mcp.json ~/.codex/config.toml .mcp.json .cursor/mcp.json 2>/dev/null

Replace, don't patch. Where the service owner publishes its own MCP server, as GitHub does, switch to it. Where none exists, pick a maintained alternative or remove the tool.
Check repositories too. A project-level .mcp.json committed to a repo is shared by everyone who opens it. Fix it there once and every engineer gets the fix on their next pull.

A rule that keeps it fixed

Glow's recommendations for security teams are short, and they match what we would suggest:

One approved server per service. Decide which GitHub, Postgres or Slack server the team uses, and write it down where agents and people both look.
Deprecation is a blocker. Make npm deprecation status part of approving any MCP server.
Ask before installing tools. Most agents can be set to ask before running install commands, and many support hooks that run before a command. A hook that refuses archived package names is a few lines.
Commit the project config. A reviewed .mcp.json in the repository gives agents a right answer, so they have less reason to improvise one.

The bigger lesson

This is not really about MCP. A model's knowledge of package names, APIs and best practices is frozen at its training cutoff, and an agent acts on that knowledge with your permissions. Anything that changed after the cutoff, a renamed package, a deprecated flag, a new official tool, has to reach the agent from somewhere else. It is the reason we built Memmo: to give agents the decisions their team has already made, such as “use GitHub's official MCP server”, as part of their context. Whatever you use, the fix is the same: write the decision down once, somewhere the agent reads before it installs anything.

Sources: Glow Labs, “MCPhantom” (November 2026), Help Net Security (3 November 2026).