Unverified50% confidenceDecision RuleExact time
Clients that read the MCP registry do not actively probe servers, but instead read and trust the records in the registry; if a record does not declare a certain transport, the client behaves as if that transport does not exist.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGoose grants trust by default to MCP servers manually added by users, so a write tool falsely labeled as read-only will be executed directly without any confirmation.77% similarUnverifiedWhen a client calls a protected MCP server without a token, it receives 401 Unauthorized, and the response header indicates the resource metadata link and the required scope.70% similarUnverifiedThe malicious MCP server disguised itself as an email-sending server with the same name as an official one, functioned normally, but secretly BCC'd every email to a third party.69% similarUnverifiedA registry/whitelist mechanism works by maintaining a pre-established list of fingerprints or public keys for known legitimate MCP servers, allowing only servers on the list to pass.67% similarUnverifiedmcp-server-fetch rejects private addresses, loopback addresses, and metadata addresses by default as an SSRF protection measure.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1022017API
curl https://kongchang.com/api/v1/knowledge/claims/1022017MCP
get_claim(id=1022017)