MCPhantom: AI coding agents are installing deprecated MCP servers
Ask an AI coding agent to set up a GitHub MCP server and there is a good chance it installs one that will never receive a security patch. Glow Labs documented this pattern across real session transcripts and named it MCPhantom.
What the research found
In 98% of the sessions Glow Labs reviewed where a deprecated MCP server was installed or suggested, the agent pulled the package name from its training data rather than checking what is current. The remaining 2% were cases where the user asked for the old package by name. In the GitHub example, the agent skipped GitHub’s own MCP server and installed a deprecated Anthropic reference server instead. That repository is archived, and the maintainers have confirmed no security updates are coming.
The same behavior turned up across Claude Code, Cursor, Codex CLI, Claude Cowork, and Claude chat, using models from Anthropic, OpenAI, and xAI.
Four vulnerabilities, zero patches
Glow Labs found four high-severity flaws in those reference servers. The most serious is a remote code execution bug in the Puppeteer server. A prompt injection is enough to redirect the agent from driving a browser to running arbitrary commands on the machine. The developer approved web browsing, and that one permission covers the rest. When Glow Labs reported the issue, it was closed as out of scope. The maintainers confirmed the server was archived in May 2025 and said no fix would come. They did indicate they would look at marking the npm package deprecated, but a deprecated package still installs through npx.
None of the flaws carry CVEs, which means SCA tooling has nothing to match against. The servers run through npx with no manifest entry, so they never show up in a dependency file. EDR sees a trusted Node process installing a public npm package and treats it as routine. No exploitation has been observed, but no patch is coming either.
The usage numbers
The deprecated packages Glow Labs counted have been downloaded from npm more than 17.3 million times since July 2025. Five of them rank in npm’s top MCP 100. Pulling them is not an option: npm only allows removal if a package had fewer than 300 downloads in the past week, has a single owner, and has no public dependents. According to Glow researcher Nadav Claude Cohen, server-github had 185,239 downloads last week and has 6 owners.
️ Who can fix this and how
Cohen identified four potential sources of a fix, each with its own constraints:
- Harness makers could refuse deprecated servers or warn before install, but only if every harness does it. One harness fixing the problem leaves the others open.
- Model makers could update training data to remove old package names, but updating model weights is expensive and Cohen considers this unlikely.
- Package owners can patch the bugs directly, which Cohen describes as the only fix that protects people still running these servers.
- Security tooling can use pre-execution hooks that many harnesses already support, which Cohen says works today without waiting on anyone else.
Glow VP of R&D Ophir Arie framed the core problem directly:
“The model’s memory is now a package manager with no deprecation feed.”
What to do now
Security teams can start without waiting for a broader fix. Glow Labs recommends finding MCP configs that reference deprecated @modelcontextprotocol servers, switching to the service owner’s official server where one exists, approving one server per service, and adding npm deprecation status to any MCP approval criteria. Asking the agent to check first does not reliably solve it: in one documented session, the agent got back “This package is deprecated” from npm and installed it anyway without telling the user.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
