How MCP servers work, what dangers they actually carry, and what we find watching the public catalog live — with our own numbers, not generic claims.
Real numbers from the public catalog: how many servers require authentication, how many ask for more than they advertise, and how often a tool changes without warning.
August 27, 2026
A near-identical name, or a letter that looks the same but isn't. How an AI agent ends up confusing a real tool for an impostor, and how we detect it.
August 27, 2026
Impersonated names, unrestricted schemas, freshly registered domains, OAuth without PKCE... pure heuristics and public-database cross-checks, zero AI cost.
August 27, 2026