{"slug": "your-mcp-server-can-change-what-it-does-between-versions-and-you-won-t-know", "title": "Your MCP server can change what it does between versions — and you won't know", "summary": "Cleiton Augusto Correa Bezerra released CleiMesh, an open-source (MIT/Apache-2.0) tool that wraps MCP servers to enforce a pinned tool grant at runtime and produce signed receipts for every call. The tool addresses silent server drift — a census of 21,643 registry servers found roughly 40% changed behavior between versions — by refusing and recording any tool or argument outside the grant, and logging a server_sha256 that changes when a server's code does. The `wrap` mode does not sandbox native server processes (receipts record `confined: false`); a separate `serve` mode runs tools in a WebAssembly sandbox.", "body_md": "MCP exploded: by mid-2026 there are **10,000+ public servers**. But trust in the ecosystem is **name-based**, and that is the problem.\n\nThe official registry **does not review code or scan for malware** — it checks that you own the GitHub repo or domain, and leaves scanning to \"downstream aggregators.\" So \"it's in the registry\" means almost nothing for safety.\n\nWorse, servers **drift**. An August 2026 census of 21,643 registry servers found:\n\nAnd star counts barely help (popularity was a weak safety signal). So you vet a server once, pin trust to its name, and a later version quietly does something else. Static scanners check a snapshot; **drift happens after the scan.**\n\nTwo properties, at runtime, on every call:\n\nThat's what I built into [CleiMesh](https://github.com/cleitonaugusto/cleimesh). You put any MCP server behind it:\n\n```\ncleimesh mcp wrap --token fetch.json -- uvx mcp-server-fetch\n```\n\nNow:\n\n`run_shell`? It's never exposed. An argument reaching outside the grant? Refused — and the refusal is receipted too.\nUnlike a scanner, this is **continuous and after-the-fact provable**: you don't trust a one-time scan, you get a signed record of what every call did, run after run.\n\n`wrap` does **not** sandbox a native server's own process — it reaches whatever its OS user can. What `wrap` gives you is a **pinned, receipted surface**: the tools/arguments the token allows, and a signed record naming the server. If you want the tool itself physically contained (default-deny, can't touch `~/.ssh` no matter what), that's `cleimesh mcp serve`, which runs tools in a WebAssembly sandbox. Use `wrap` for native servers you don't control; `serve` for tools you run under CleiMesh.\n\nA vetted MCP server advertises one tool, `search`. A later version keeps the same identity but silently adds a dangerous `run_shell`. Behind `cleimesh mcp wrap`, with a token that grants only `search`:\n\n```\nToken grants exactly one tool: search.\n\n== v1  (vetted server: advertises only 'search') ==\n  client sees tools: ['search']\n  search -> ok\n\n== v2  (SILENT DRIFT: same identity, now also advertises 'run_shell') ==\n  client sees tools: ['search']\n  search -> ok\n  run_shell -> REFUSED\n\n== What the signed receipts recorded ==\n  tool       decision  server_sha256 (names which server ran)\n  search     allowed   4ae7d7e537ca9144...\n  search     allowed   edcfb70e2b2e9ada...\n  run_shell  denied    - (denied before dispatch)\n```\n\nThree things the signed receipts prove: the drifted `run_shell` was **never exposed** (the grant pins the tool surface); the attempt was **refused and recorded**; and the `server_sha256` **changed between versions** — so the drift is in the log, not silent. (`wrap` does not sandbox the native server, and the receipt says so: `confined: false`. For a tool you want physically contained, run it under `cleimesh mcp serve`, in WASM.)\n\nMCP trust today is \"I vetted the name once.\" That doesn't survive 40% silent drift. The fix isn't another catalog or another one-time scan — it's **enforcing the grant and proving every call at runtime**, so a server that changes what it does is *bounded* and *caught*.\n\nFree and open (MIT/Apache-2.0): **[https://github.com/cleitonaugusto/cleimesh](https://github.com/cleitonaugusto/cleimesh)** — the `cleimesh-mcp` skill on ClawHub sets it up. Point it at the MCP servers your agent already uses and look at the receipts.\n\n— Cleiton Augusto Correa Bezerra ([github.com/cleitonaugusto](https://github.com/cleitonaugusto))", "url": "https://wpnews.pro/news/your-mcp-server-can-change-what-it-does-between-versions-and-you-won-t-know", "canonical_source": "https://dev.to/cleiton_augusto_/your-mcp-server-can-change-what-it-does-between-versions-and-you-wont-know-37dn", "published_at": "2026-11-03 11:42:25+00:00", "updated_at": "2026-11-03 11:52:59.580154+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "ai-safety", "developer-tools"], "entities": ["CleiMesh", "Cleiton Augusto Correa Bezerra", "MCP", "GitHub", "ClawHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-mcp-server-can-change-what-it-does-between-versions-and-you-won-t-know", "markdown": "https://wpnews.pro/news/your-mcp-server-can-change-what-it-does-between-versions-and-you-won-t-know.md", "text": "https://wpnews.pro/news/your-mcp-server-can-change-what-it-does-between-versions-and-you-won-t-know.txt", "jsonld": "https://wpnews.pro/news/your-mcp-server-can-change-what-it-does-between-versions-and-you-won-t-know.jsonld"}}