{
 "slug": "mcp-supply-chain-drift-hazard",
 "url": "https://stillosdigitalholdings.com/findings/mcp-supply-chain-drift-hazard",
 "question": "How often does installed agent/MCP code drift away from the version an audit certified, and what is the drift-hazard rate an underwriter would price on?",
 "headline": "By 30 days, 8.94% of audited MCP servers have had their installed code move while the approval artifact still matches.",
 "cite_as": "8.94% cumulative drift-hazard at 30 days: the installed code of an audited MCP server moved while its approval artifact still matched (Still OS Digital Holdings LLC, AI-supply-chain drift-hazard baseline, Kaplan-Meier over n=55,692 servers / 34,454 publishers, 44-day census).",
 "numbers": {
  "Drift-hazard at 7 days": "4.5%",
  "Drift-hazard at 14 days": "6.21%",
  "Drift-hazard at 30 days": "8.94%",
  "Drift-hazard at 44 days": "12.74%",
  "Share of transitions that drifted": "35.21%",
  "Silent drift (surface moved under an unchanged version) at 30 days": "1.65%",
  "Audited servers in the risk set": "54,776",
  "Publishers observed": "34,454",
  "Census horizon": "44 days"
 },
 "method": "Kaplan-Meier cumulative incidence over a dated daily census of the MCP / agent-tool economy, censored at disappearance or horizon. A transition counts when the install fingerprint moves while the invocation fingerprint an auditor would check stays identical. Robustness is leave-one-out by publisher. Every figure re-derives from the dated series; the time series cannot be backfilled by anyone, including us.",
 "producers": [
  "/home/marcus/state/mcp-census/drift-hazard-latest.json"
 ]
}