Surface history — mcp.scanmalware.com

An observation record, not an assessment. Every row below is a change we recorded directly, with the content hash before and after. https://mcp.scanmalware.com/mcp

distinct tool surfaces served

transitions observed

carried no version signal

128

tools on the current surface

2 of these transitions happened while the reported version string stayed the same. A consumer pinning that version would have received a different tool surface with nothing in the version to indicate it. That is a compatibility and review fact, not a security finding and not an allegation of wrongdoing — unversioned iteration is normal practice and is frequently deliberate.

Recorded changes

observed at (UTC)	change	version signal	reported version	tools	surface hash
2026-10-08 13:40:03Z	DESCRIPTION_CHANGED	version-signalled	1.30.0 → 0.1.6	no tool-name change recorded	0a7547616a36 → 262818e83580
2026-10-08 13:40:03Z	PARAMS_CHANGED	version-signalled	1.30.0 → 0.1.6	no tool-name change recorded	d3f4e2b7431d → 957e026a4a1e
2026-10-08 13:40:03Z	SURFACE_CHANGED	version-signalled	1.30.0 → 0.1.6	+get_js_runtime_behaviour +get_js_runtime_coverage +get_js_runtime_health +get_js_runtime_stats +search_js_runtime_by_composite_hash +search_js_runtime_by_signature +search_js_runtime_similar −get_js_fingerprinter2 −get_js_fingerprinter2_coverage −get_js_fingerprinter2_health −get_js_fingerprinter2_stats −search_js_fingerprinter2_composite_hash −search_js_fingerprinter2_signature −search_js_fingerprinter2_similar	36a9ab0ffc7b → f2025a4ef318
2026-10-08 01:40:02Z	DESCRIPTION_CHANGED	SILENT — version string did not move	1.30.0 (unchanged)	no tool-name change recorded	f25ce1b31178 → 0a7547616a36
2026-10-08 01:40:02Z	PARAMS_CHANGED	SILENT — version string did not move	1.30.0 (unchanged)	no tool-name change recorded	8c18fdc3ba6f → d3f4e2b7431d

Right of reply. If any row is wrong — a change we attributed to you that isn't yours, a hash that doesn't match, a host that was reassigned — say so and we will correct or withdraw the record and publish the correction alongside it. Dispute or correct this record. We will also remove this page on request from the operator of mcp.scanmalware.com.

Ecosystem context — not specific to this server

This section is identical for ~92% of publishers and is published as shared context, not as a finding about mcp.scanmalware.com. 90 dependency packages sit beneath the measured MCP population; 41 have a single maintainer and 31 have not published in over two years. The widest is zod at 80.46% of npm-backed servers (8529 servers, 1 maintainer, last publish 2026-09-13). These are properties of the shared SDK dependency closure. Any page claiming this set as one operator's personal exposure is misreading a universal fact as a private one.
Source: state/mcp-census/chokepoint-maintainers.json, as_of 2026-10-07.

Coverage and limits

Observation window 2026-09-21 → 2026-10-10. 22,294 servers were observed; 2,214 were seen to change and 20,080 were observed and recorded no change — that negative control is why a non-zero count here means something. Across the corpus, 4,781 of 6,334 changes carried no version signal, and 1,690 of those added or removed tools.

What this does NOT cover: servers outside the observed set; changes that occurred before 2026-09-21; changes that began and reverted between two observations; and any server reachable only with credentials we do not hold. A server's absence from this record is not evidence it did not change — only that we did not observe it.

Universe captured 2026-10-10T19:40:03.823Z. Produced by core/surface_history_page.cjs (reads core/surface_clock producers). Hashes are of the served tool surface and are recomputable from the server's own response.