Your MCP server can change what it does between versions — and you won't know

By mid-2026, there are over 10,000 public MCP servers. Trust in this ecosystem is based on name alone, which is problematic. The official registry does not review code or check for malware; it merely verifies ownership of the GitHub repo or domain. This lack of security leaves the responsibility for scanning to downstream aggregators.

As a result, servers can change what they advertise between versions, and these changes can occur silently without detection. Additionally, servers can redirect their remote endpoint to a different host while keeping the same registry identity. While the number of stars a server has received is not a reliable indicator of safety.

However, this trust issue can be addressed. Two properties should be enforced at runtime for every call: first, making drift non-silent, and second, bounding the surface that the client can access. This is what CleiMesh has implemented. You can use CleiMesh to wrap any MCP server, such as `cleimesh mcp wrap --token fetch.json -- uvx mcp-server-fetch`.

This ensures that every call leaves a signed, hash-chained receipt, naming the server by the digest of its command line. If the server is swapped, the digest in the receipts will change, making drift visible and provable rather than silent. The client will only see the tools permitted by the token, and each call will be checked against the token's argument constraints.

This continuous and provable verification ensures that servers with changed functionality are caught, as opposed to a one-time scan that may miss such drifts.