MCPTrust — Declared-Versus-Observed Capability Drift Across MCP Server Versions

Status: Full run complete · part of the agent-authorization and tool-security line of work.

The question

An MCP server’s documentation is the contract an agent is configured against. MCPTrust asks how far the code has drifted from that contract, and whether drift accumulates silently across versions.

The corpus contains genuinely obfuscated code, so the study runs under a hard safety contract: repositories are read in place, read-only, nothing is copied out, no repository code is executed or imported — Python is parsed with ast, JS/TS with regexes, and git is the only process spawned.

Results so far

• Two thirds of real servers can do things their documentation never mentions. 1,191 of 1,777 repositories (67%) carry code capabilities absent from their docs.
• Version upgrades are where undocumented capability enters. 645 version pairs gained a capability; 466 (72%) were undocumented, and 389 of those were high-impact — shell execution, dynamic eval, network egress, secrets access, file write or delete.
• Policy-conditioned probing beats random probing at small budgets. At a budget of 5 probes, policy-conditioned yields 7.07 verified findings per 100 against random’s 3.87 — +3.20 [+2.13, +4.33] — with recall of 0.49 against 0.27. The advantage narrows as budget grows (at 20 probes, +0.33 [+0.20, +0.48]), which is the honest reading: targeting buys the most when you can afford the least.