Coding agents keep installing abandoned MCP servers. How to find and replace them

What Glow Labs found

Glow Labs, the research team at Glow Security, published a pattern it calls MCPhantom on November 2, 2026: coding agents setting up MCP servers that their maintainers have abandoned. MCP servers are the plug-ins that connect an agent to GitHub, Slack, a database or a browser.

Reviewing real coding session transcripts, Glow found that “In 98% of the sessions where an agent set up a deprecated MCP server,” the agent appears to have picked it because the name was in the model’s training data. In the other 2%, the user asked for the old package by name. Its example: asked for “a GitHub MCP,” an agent passed over “the official MCP server that GitHub maintains” for a deprecated Anthropic one it remembered.

It wasn’t one product. Glow saw the same thing in Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, with models from Anthropic, OpenAI and xAI. Glow doesn’t say how many sessions it reviewed, and it looked only at sessions where a deprecated server was installed or suggested, so the 98% says why agents chose these servers, not how often they do. Glow sells software that finds them, and its post ends with a pitch for it.

Checking first didn’t help either. “In one session the agent checked the package on npm and got back ‘This package is deprecated,’” Glow’s Nadav Claude Cohen told Help Net Security. “It installed the package anyway and never told the user.”

Which servers, and what replaced them

When Anthropic launched MCP in 2024, it published a set of reference servers to show how integrations work. MCP’s servers repository now lists 13 of them as archived, and the archive says: “NO SECURITY GUARANTEES ARE PROVIDED FOR THESE ARCHIVED SERVERS,” and “No security updates or bug fixes will be provided.” npm marks every one of the npm packages “no longer supported.”

Seven reference servers are still maintained: Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time. @modelcontextprotocol/server-filesystem is fine. These aren’t:

Archived server	Package	npm downloads since July 10, 2025	Maintained alternative
GitHub	@modelcontextprotocol/server-github	5,266,085	GitHub’s own, hosted at https://api.githubcopilot.com/mcp/
PostgreSQL	@modelcontextprotocol/server-postgres	4,312,874	None named; PostgreSQL has no single owner
Slack	@modelcontextprotocol/server-slack	3,198,630	Slack’s own, at https://mcp.slack.com/mcp
Puppeteer	@modelcontextprotocol/server-puppeteer	1,487,526	Chrome DevTools MCP or Playwright MCP
Brave Search	@modelcontextprotocol/server-brave-search	1,461,811	Brave’s own, @brave/brave-search-mcp-server
Google Maps	@modelcontextprotocol/server-google-maps	814,615	None named
GitLab	@modelcontextprotocol/server-gitlab	273,296	GitLab’s own, at /api/v4/mcp on your GitLab
Google Drive	@modelcontextprotocol/server-gdrive	247,891	None named
Redis	@modelcontextprotocol/server-redis	131,160	Redis’s own, redis-mcp-server
AWS KB Retrieval	@modelcontextprotocol/server-aws-kb-retrieval	23,028	AWS Labs’ awslabs.bedrock-kb-retrieval-mcp-server
EverArt	@modelcontextprotocol/server-everart	12,817	None named
Sentry	mcp-server-sentry, on PyPI	Not in Glow’s count	Sentry’s own, at https://mcp.sentry.dev/mcp
SQLite	mcp-server-sqlite, on PyPI	Not in Glow’s count	None named

The download counts are Glow’s. Its total of 17,352,267 also counts create-server, a tool for starting a new server project. MCP’s repository names only two successors: Brave’s server for Brave Search, and a fork by Zencoder for Slack. The other alternatives are the services’ own servers, from their own docs.

The packages are still busy. In the week to November 1, npm counted 208,713 downloads of server-github, 173,865 of server-slack and 164,787 of server-postgres. server-github’s last release was on April 8, 2025.

The Puppeteer flaw, and why no fix is coming

Glow found four high-severity flaws in these servers and has described one. The Puppeteer server lets an agent drive a browser, and “with a prompt injection, an attacker can make the agent start any process on the machine instead of the browser and run any command.” A prompt injection is text on a web page or in a file that’s written to give the agent instructions. Because “the developer allowed the agent to browse the web,” Glow says, “that permission ends up covering any command,” so the agent’s own safeguards don’t stop it.

Glow first reported a flaw through HackerOne on July 30, 2026, and reported all four to Anthropic’s CVE numbering authority between October 4 and 11. The maintainers replied that the server was archived in May 2025 and “is unmaintained, so no fix or release will come from this repository,” and closed the report as out of scope.

Glow hasn’t seen anyone exploit the flaws. Help Net Security notes they have no CVEs, so tools that scan for known vulnerabilities have nothing to match, and a server an agent starts with npx appears in no project’s dependency files. npm’s deprecation hides a package from search, but in Glow’s words, “npx will still install it with nothing more than a warning.” The old names are everywhere agents learned from: MCP’s own guide to local servers still uses @modelcontextprotocol/server-brave-search in a troubleshooting example.

How to check your computer

1. List each agent’s servers. Run claude mcp list for Claude Code and codex mcp list for Codex. Claude Code keeps its servers in ~/.claude.json and each project’s .mcp.json; Codex in ~/.codex/config.toml and a trusted project’s .codex/config.toml; Cursor in ~/.cursor/mcp.json and a project’s .cursor/mcp.json; Claude’s desktop app in claude_desktop_config.json.

2. Search those files for the archived packages. On a Mac, from a project folder:

   grep -nE "@modelcontextprotocol/server-(github|gitlab|postgres|slack|puppeteer|brave-search|google-maps|gdrive|redis|everart|aws-kb-retrieval)|mcp-server-(sentry|sqlite)" \
     ~/.claude.json ~/.codex/config.toml ~/.cursor/mcp.json \
     "$HOME/Library/Application Support/Claude/claude_desktop_config.json" \
     .mcp.json .codex/config.toml .cursor/mcp.json 2>/dev/null

   On Linux, Claude’s desktop config is in ~/.config/Claude/. A server’s name in your config can be anything, so look at the package in its command, not the name.

3. Remove what you find. claude mcp remove <name> in Claude Code, adding --scope if it’s defined in more than one place. In Codex, delete the server’s [mcp_servers.<name>] table from config.toml; in Cursor and the desktop app, delete its entry from the JSON file.

4. Add the service’s own server. For GitHub, its Claude Code guide and Codex guide give:

   claude mcp add --transport http github https://api.githubcopilot.com/mcp -H "Authorization: Bearer YOUR_GITHUB_PAT"
   codex mcp add github --url https://api.githubcopilot.com/mcp/ --bearer-token-env-var GITHUB_PAT_TOKEN

Keep them from coming back

• Tell the agent which server to use. Glow’s advice to security teams is to “Approve one MCP server per service.” For one person, that’s a line in CLAUDE.md or AGENTS.md naming the server for each service you use, since the agent won’t reliably look it up.
• Block them in Claude Code. deniedMcpServers works in your own ~/.claude/settings.json, and Claude Code’s docs say “Nothing overrides a denylist match.” Entries match the exact command, “Every argument, in order,” so list each form you’ve seen, such as { "serverCommand": ["npx", "-y", "@modelcontextprotocol/server-puppeteer"] }. A blocked server disappears from /mcp and claude mcp list. Teams can go further with an approved list, allowedMcpServers with allowManagedMcpServersOnly, and Cursor’s Enterprise admins have an MCP allowlist under Team Settings.
• Read installs before you allow them. In a mode that asks first, adding a server shows up as a command or an edit to a config file, and the package name is in it. Enjoy shows an agent’s requests as cards to allow or decline, so an npx command naming one of the packages above is one to decline. Broad modes such as Bypass permissions and Full access skip the question, which is one more reason to keep them for work you trust.
• Swap Puppeteer first. It’s the flaw Glow has described, and a browser is where an agent reads the most text written by strangers.

What hasn’t been said

• The other three flaws. Glow hasn’t described them or said which servers they’re in.
• How common this is. Glow gives no count of sessions, and it studied only sessions where a deprecated server turned up.
• Whether agents will warn. Cohen says harness makers could refuse deprecated servers, but “it works only if every harness does it.” We found nothing from Anthropic, OpenAI, Cursor or xAI by November 3 saying their agents will.
• Whether the packages will go. npm lets an owner remove a package only with fewer than 300 downloads in the past week, a single owner and no public dependents. “server-github had 185,239 downloads last week and has 6 owners,” Cohen says.