ControlLoopStart free trial

Catch an MCP server that changes behind the same name

An MCP server is code someone else maintains, and every tool it exposes is something your agent can do. When its package, version, or command changes, your agent's authority changes, even though the server's name in .mcp.json does not.

Start free trial Get the CLI on GitHub

Team: 7 days free, then $199 a month per organization. Cancel any time. Compare plans →

Same name, different server

In September 2025, version 1.0.16 of postmark-mcp, an unofficial MCP server for the Postmark email API, began copying every email it sent to an outside address. Fifteen earlier releases had behaved as advertised, and the configuration that installed it named the same server every time.

Reviewing MCP servers by name misses this. What matters is which package, at which version, run by which command, and whether anyone in your organization approved that combination.

What ControlLoop reports on the pull request
.mcp.json
  "postmark": {
    "command": "npx",
-    "args": ["-y", "postmark-mcp@1.0.15"]
+    "args": ["-y", "postmark-mcp@1.0.16"]
  }
policy.mcp-server-identity-changeHigh

The MCP server postmark changed version behind the same name: postmark-mcp 1.0.15 became 1.0.16.

policy.unsanctioned-agent-componentMedium

postmark-mcp 1.0.16 is outside the organization's approved version range. Review required.

×
ControlLoop gateDeployment blocked
EXIT 1

What ControlLoop reports

Identity changes behind an unchanged name

A changed package, version, or command is high severity. Any other change to a server's identity, or a newly added server, is medium.

Unpinned plugins and marketplaces

A plugin or marketplace added without a commit or digest pin is reported, because what it does can change upstream with no change in your repository.

Your organization's approved list

On Team, every new grant is checked against an approved-components list with name, package, version range, digest, command pattern, and pin constraints.

How it works

  1. 01

    List what you trust

    Record the MCP servers, plugins, and versions your organization approves, once, for every repository.

  2. 02

    Gate every change

    Each pull request that adds or changes a server is compared with the baseline and with the approved list.

  3. 03

    Review the exceptions

    Unapproved components land in a review queue with the constraint that failed, instead of slipping through.

Questions

Does ControlLoop start MCP servers or fetch their tool lists?

No. Scans are static and need no network. ControlLoop reads the configuration that declares each server and never starts it, calls its tools, or contacts its endpoints.

Which MCP configuration files are read?

Project MCP configuration for the supported agent hosts, including .mcp.json, .vscode/mcp.json, .cursor/mcp.json, and the MCP sections of Codex and Gemini CLI settings.

Can an unapproved server block the merge instead of asking for review?

Yes. Unapproved components require review by default. An organization can raise their severity floor to high or critical so the gate blocks them instead.

Go deeper

Read the guide: MCP server security: know what each server lets your agent do

More use cases