Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, and Why Drift-Ranked Re-Auditing Under-Covers It

Abstract

A longitudinal measurement of description staleness in the official Model Context Protocol (MCP) registry. Security studies of the MCP ecosystem each audit a registry at a single point in time; none reports how long the descriptions they judged stay current, which is a necessary condition for any description-level finding to still apply. We reconstruct 120 observations of the official MCP registry over 88.6 days, covering 19,099 distinct servers as it grew from 3,510 to 18,966 active servers. The central result is a policy one: description-level findings cannot be kept current by re-auditing the servers that drift most. At a top-5% re-audit budget, ranking by prior drift catches only about 20% of the previously-seen servers whose description changes in a held-out window, and only about 10% of all description changers. The limit is not that description drift is unpredictable: prior description change lifts next-period probability 4.8x (13.8% versus 2.8%). It is that the signal is exhausted almost immediately, because only 5.0% of the population carries any prior description change at all, against 16.4% for descriptors. A top-5% budget therefore consumes the entire ranking and caps near 20% coverage, and every slot beyond it is filled by tie-break rather than by signal. Roughly half of all description changes then land on new arrivals that a history ranking cannot reach by construction. The control that fits is content-binding, meaning revalidation the moment a description's hash moves, plus a sized periodic full-catalog sweep for the new arrivals and the tail. This measures the shelf-life of the audited text, not the validity of a security finding itself, which turns on live tool behavior we do not observe. The panel, the analysis code, and the figure generators are released under CC-BY-4.0 at DOI 10.5281/zenodo.21709945.