Whoever takes your old GitHub name gets your MCP namespace

A security researcher found that at least 111 GitHub usernames tied to published MCP servers in the official registry have since been renamed or deleted, leaving those io.github namespaces unclaimed and open to takeover. Because the registry derives io.github.<login>/* permissions from the current GitHub login rather than an immutable account ID, anyone who registers a freed username can publish new versions of the affected servers, including high-download packages like aiterm-mcp, agents-fleet, and Shodan and VirusTotal integrations that run with users' API keys. The researcher advises re-registering old names and pinning MCP packages by version rather than trusting registry names.

Rename your GitHub account and your MCP servers stay in the official registry under your old name. Whoever registers that name next can publish new versions of them, and the registry can't tell it isn't you. On 2 November I checked every io.github name in the registry against GitHub. At least 111 names that published servers have since been renamed or deleted, and don't belong to any account now. Between them: They're not toys, either. Here are the busiest: Weekly downloads of the busiest servers under unclaimed names the data https://raw.githubusercontent.com/NotAFlightRisk/blog/main/posts/whoever-takes-your-github-name/busiest.json These are npm and PyPI downloads over the last week, as of 2 November. Each one is listed in the registry under a GitHub name that nobody holds now. aiterm-mcp lets your coding agent drive terminals, agents-fleet reaches every machine you've got over SSH, the Shodan and VirusTotal ones run with your API keys for those services, and azure-board-mcp wants a personal access token. Further down the list, four more handle crypto wallets, payments or transactions. The registry hands out io.github.<login / based on your GitHub login, not your account's ID, which is the bit that never changes github at.go https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/auth/github at.go : permissions := h.buildPermissions user.Login, orgs When you rename, GitHub's docs say your old name becomes available for anyone else to claim https://docs.github.com/en/account-and-profile/concepts/username-changes . Whoever claims it gets your namespace, and from there: latest A local MCP server runs as you, with whatever keys you put in its config. A remote one sees every tool call your agent makes to it, and gets to write the answers. If you installed the npm or PyPI package directly, a new registry version doesn't touch you. It's the clients and galleries that pick servers from the registry by name that would follow it, and the registry tells aggregators https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/registry-aggregators.mdx to copy it and keep their own copy. 22 namespaces in the registry now belong to a GitHub account that was created after they were published. io.github.facebook is one, since Meta became meta on 28 October. So far most of them look like owners holding on to their old name, and none has published anything. The other half has bitten for real. About twenty publishers have filed tickets since April because they're locked out of their own old entries, like PaidSync https://github.com/modelcontextprotocol/registry/issues/1662 , whose old listing kept advertising an address they'd switched off until a maintainer stepped in. Register your old name again today. An empty org costs nothing. Once you hold the name, nobody else can publish there, and you can deprecate the old entries yourself. If you install MCP servers, pin the package and version rather than trusting the registry name, and treat a change of package or URL between versions like a new server.