We added 8 new detections without using AI: here's how they work
August 27, 2026
Pure heuristics and public-database cross-checks — zero model calls, zero extra cost.
We expanded Centinela's detection catalog with 8 new categories. None of them use AI — all of them are direct heuristics over what a server already publishes, or a cross-check against a free public data source, the same way we already handle domain typosquatting or known vulnerabilities from OSV.dev. We applied all 8 at once across the catalog's 12,707 servers in an 8-minute pass, without waiting for the normal scan cycle.
The 8 detections
Impersonated tool name (tool shadowing)
A name near-identical — via homoglyphs or a typo — to an extremely common tool. We covered this in a dedicated article.
Hidden padding in a description
Dozens of consecutive line breaks or spaces before the real content, hiding text outside what a client's approval UI shows.
OAuth authentication without PKCE
The authorization server follows the MCP standard, but doesn't advertise PKCE support with S256 — required by OAuth 2.1, the base of that standard.
Recently registered domain
The actual domain serving the MCP — not the repository its code lives in, which can differ — was registered less than 30 days ago, checked via RDAP, the standard successor to WHOIS.
Known malicious domain
The domain appears on URLhaus as already-confirmed phishing, malware, or C2 infrastructure — a direct match, not a guess.
Schema open to any field
The schema deliberately declares additionalProperties: true without defining any property — accepts arbitrary JSON that was never advertised.
Safety switch off by default
A boolean safety parameter (confirm, force, skip verification) whose default value leaves the protection off without the agent having to ask for it.
Coordinated change across servers (retired — see note below)
Several unrelated servers change a tool within the same 24-hour window — a sign that a dependency shared by many was compromised at once.
What we found running them
On the first pass across the whole catalog: 231 tools with an unrestricted schema, 70 tools with a safety switch off by default, 29 suspicious tool names, 29 recently registered domains, and 5 servers with OAuth missing PKCE. Zero failures across the 12,707 checks.
The full detail of how each one works — and the other 15 categories that already existed — is in How Centinela works. You can see the real findings, updated live, on the Board.