Findings

How often does an MCP server change the tools it exposes without changing its version number?

78.7% of observed MCP tool-surface changes carried no version change.

When an MCP tool keeps its name but quietly changes the parameters it accepts, does anything signal it?

3,386 observed MCP parameter changes — and 73.6% carried no version change.

Who actually controls the packages the whole MCP ecosystem is built on top of?

41 of 90 dependency-floor packages have a single maintainer — 19 individuals hold all of them.

When a machine-callable service advertises itself as payment-ready, does it actually charge for anything?

Of 601 services advertising payment-readiness, 158 (26.3%) actually gate anything behind payment.

Do public data portals actually refresh their datasets as often as they say they do?

103 of 105 dataset observations were past their own advertised refresh cadence.

When an AI answer engine crawls a site thousands of times, how often does it actually cite that site to a human?

52,413 verified ingestion fetches across 52,333 distinct URLs produced 5 verified live-answer fetches.

Can this company prove that external parties have paid it, in a way a stranger can recompute?

8 external settlements from 6 distinct counterparties, every one recomputable from its transaction hash.

What does an independent MCP server security audit actually cost, and who publishes a price?

Published MCP-audit prices run $299 to $25,000 — and 0 of 6 priced competitor offerings name a single customer.

How many raw static analysis hits does one reportable MCP finding survive out of, and who publishes that number?

1,574 raw static sink hits across 98 MCP packages reduced to 15 reportable findings — a 99.0% reduction, published.

Do AI-liability insurers require an independent third-party audit before they will cover an AI agent?

Of 2 AI-liability programmes read at source, 1 requires an independent accredited auditor and 1 states no external prerequisite at all.