Five archived MCP servers are still being downloaded every day
by•
I followed five reference servers the MCP project archived in May 2025. They've grown more than fourfold since. The Postgres one has a known SQL injection whose fix was merged the day it was archived and never shipped. Write up and data in the comments. How do you check whether a server in your config is still maintained?
31 views
Replies
My agent wired up a dead MCP package, silently swallowed the missing endpoint errors, and told me the full schema sync completed. A broken package is easy to swap, but reporting zero errors when nothing ran is why I stripped its install permissions.
@konstantin_tikhaev same lesson on our side.. a swallowed error once came back looking like an empty result and we read it as all clear. now an error has to show up as an error, never as zero. did the agent pick that package itself or was it already in your config?
@neelagiri_chettiyar It picked the package itself from the task description. It was not anywhere in the config or the lockfile.
@konstantin_tikhaev that's the scarier half.. a lockfile only covers what's already in it and an agent picking from the task text never goes near it. with strict mode on, anything never approved waits until a person looks.. same as a changed tool.
@neelagiri_chettiyar Human approval works, but the tool registry is immutable. If a package is not baked into the build, the agent cannot even request it.
write-up: https://medium.com/@srinathprasanna/five-mcp-servers-were-archived-17-months-ago-their-downloads-have-quadrupled-since-2250795b6222 .. numbers and the script: https://github.com/gawk-dev/mcpg...