On November 2, Glow Security published research it calls MCPhantom: AI coding agents keep installing MCP servers that were archived more than a year ago. In 98% of the sessions where an agent set up one of these deprecated servers, the user had not asked for it by name. The agent filled in the package from what its model remembered. Help Net Security covered it on November 3.

We wanted to know if this is still happening at scale, so we checked npm ourselves.

The numbers from npm

These are the twelve packages Glow lists, all under @modelcontextprotocol, with downloads for the week of October 27 to November 2, 2026, from the public npm downloads API. Every one of them is marked deprecated in the npm registry today.

Package Downloads last week
server-github 200,397
server-slack 176,607
server-postgres 158,147
server-brave-search 31,665
server-puppeteer 30,673
server-google-maps 7,442
server-gdrive 6,049
server-gitlab 5,398
server-redis 3,964
server-aws-kb-retrieval 189
create-server 173
server-everart 134
Total 620,838

npm download counts include CI runs and mirrors, so this is not 620,838 developers. It does show that the deprecation flag is not stopping anyone. npx -y prints a warning and installs the package anyway, and an agent running that command in a terminal has no reason to stop on a warning.

What is wrong with them

Glow reported four high-severity flaws across these servers. The worst is in server-puppeteer: a prompt injection on a page the agent visits can make it start any process on the machine instead of the browser. The developer approved web browsing, and that one approval covers everything after it.

The maintainers closed the report as out of scope because the servers live in the archived repository and are unmaintained. There are no CVEs, so dependency scanners that work from CVE feeds will not flag them. Glow says it has not seen anyone exploit these flaws. We are not claiming otherwise.

Find them in your configs

This lists every deprecated reference server in the usual MCP config files for Claude Code, Cursor, VS Code, Codex CLI and Claude Desktop on a Mac. Run it in each repo root, since project configs live there.

grep -HnoE '@modelcontextprotocol/(server-(github|gitlab|postgres|slack|puppeteer|brave-search|google-maps|gdrive|redis|aws-kb-retrieval|everart)|create-server)' \ .mcp.json .cursor/mcp.json .vscode/mcp.json \ ~/.claude.json ~/.cursor/mcp.json ~/.codex/config.toml \ "$HOME/Library/Application Support/Claude/claude_desktop_config.json" 2>/dev/null

No output means none of those files reference them. Some servers from the same repository are still maintained, such as server-filesystem and server-memory, which is why the pattern names packages one by one instead of matching the whole scope.

What we would run instead

Move to the server the service owner maintains, where one exists:

For Slack, Postgres and the rest, check whether the vendor ships its own server before picking a community one, and read its tool list before you approve it.

Stop the agent from adding them again

Swapping today's configs is not enough if the agent adds the old package back next week. Two things we would set up:

  1. Write the approved list down where the agent reads it. One line in CLAUDE.md or AGENTS.md, such as "Use only these MCP servers: ...", changes what the agent proposes. It is a suggestion to the model, not a control.
  2. Block the install itself. A pre-tool hook (Claude Code supports PreToolUse hooks on Bash) can reject any command that mentions one of these package names. That works whatever the model remembers.

Glow's own advice adds a third: put npm deprecation status into whatever approves a new MCP server. A lookup before install helps, but Glow's researcher also notes it is not enough on its own, which is why we would still keep the hook.

If you run a remote MCP server and want to see what a client sees before it connects, our free MCP Server Check looks at auth, OAuth discovery and tool descriptions from the outside without calling any tool.

Originally published at x1y1.co.