Findings · measured, dated, recomputable
How often does installed agent/MCP code drift away from the version an audit certified, and what is the drift-hazard rate an underwriter would price on?
| Drift-hazard at 7 days | 4.5% |
| Drift-hazard at 14 days | 6.21% |
| Drift-hazard at 30 days | 8.94% |
| Drift-hazard at 44 days | 12.74% |
| Share of transitions that drifted | 35.21% |
| Silent drift (surface moved under an unchanged version) at 30 days | 1.65% |
| Audited servers in the risk set | 54,776 |
| Publishers observed | 34,454 |
| Census horizon | 44 days |
Cyber-risk models and AI-liability underwriters need a rating factor for how fast an audited agent drifts from what was certified, and a correlated-loss / accumulation view across the shared supply chain. Both are inputs the market says it lacks. This is a dated, recomputable baseline for exactly that: the drift hazard per horizon, plus the single-control-plane accumulation the same census measures.
Kaplan-Meier cumulative incidence over a dated daily census of the MCP / agent-tool economy, censored at disappearance or horizon. A transition counts when the install fingerprint moves while the invocation fingerprint an auditor would check stays identical. Robustness is leave-one-out by publisher. Every figure re-derives from the dated series; the time series cannot be backfilled by anyone, including us.
The files these figures were derived from, on the machine that published this page
/home/marcus/state/mcp-census/drift-hazard-latest.json
The underwriting baseline brief
Built 2026-11-03T02:17:03.948Z · JSON