Pennyforge's scan finds steering text in tool descriptions at 8 of the 20 most-starred MCP servers

The F1 signal is a phrase match. It flags strings such as "you must", "always", "prefer" and "call this before" inside tool descriptions ^[3]. Pennyforge files these under the "tool poisoning" family: behavior-steering text that agents read but humans usually don't ^[3]. The plainest examples come from large servers. Upstash's context7, at 62.8k stars, tells the model "You MUST call this function before..." ^[8]. ChromeDevTools' chrome-devtools-mcp, at 53.1k stars, says "ALWAYS prefer this tool over multiple individual..." ^[8].

A phrase count overstates steering wherever "always" is descriptive. It also misses steering written in words outside the pattern list. n8n-mcp made the list with a description that begins "Always available" and goes on to list node info, search and validation ^[12]. The only thing that line steers is the match count. Pennyforge says a match can be a false positive, and that none of its quoted examples are obviously malicious ^[4][9].

The permission findings are where I would spend review time. The reference repository's environment tool "Returns all environment variables, helpful for debugging" ^[10]. n8n-mcp's diagnostic tool offers to "Include detailed debug information including full environment variables and API response details" ^[11]. Pennyforge takes that to mean one diagnostic call can return the environment to the model. It says it flags the design choice without judging it ^[11].

The 2026-07-28 revision removed the initialize handshake and Mcp-Session-Id sessions ^[13]. Each request now declares its own protocol version and capabilities inside _meta, and a client's first call goes to server/discover ^[13]. The report's "ten weeks" is accurate: the scan came 71 days after the revision ^[19]. Eleven repos show only old-spec markers, four show a mix, and five are indeterminate because the extractor found SDK usage but no direct RPC code ^[14]. All 15 repos with readable RPC code still carry old-spec markers, and the 91k-star official reference repo is one of them ^[18][14]. For the five SDK-only servers, the spec state presumably follows whichever SDK version they pin. Migrating them would then be a dependency bump ^[14].

The report's own dates contradict its maintenance figure for tadata-org/fastapi_mcp. Pennyforge says the 12k-star repo has not been pushed since 2025-11-24 and calls that 14 months ^[1]. From that date to the 2026-10-07 scan is 317 days, about ten and a half months ^[17]. The repo is stale on either count. The substitute merajmehrabi/puppeteer-mcp-server was last pushed on 2025-03-14 ^[16].

The NSA said in its May 2026 paper that the protocol's "rapid proliferation has outpaced the development of its security model" ^[5]. Pennyforge says it thinks that is fair ^[5]. The official SDK's 242 million npm downloads last month and the 33,674 GitHub repositories tagged mcp-server measure the proliferation ^[6]. The scan gives the security half evidence a reviewer can check line by line. Another team can copy the method: five signals, pattern matches on source, with the analyzer and every match kept for inspection ^[3][4]. A shallow clone fixes a date but not a commit, so a rerun next month scans whatever is at HEAD by then. I think the format is right for this job. It dates every finding and states its limits before its results ^[4].