Researcher finds 111 orphaned io.github MCP namespaces open to takeover
11/03/2026 — 11/03, 03:17·1 sources (all)·1 reports (all)
Key takeaways
- After cross-checking every io.github name in the official MCP registry against GitHub accounts, a researcher found at least 111 names that o…
- anyone claiming the username could publish new versions that the registry cannot distinguish from genuine ones.
Background & analysis
On 2 November 2026, a researcher checked every io.github name listed in the official MCP registry against the corresponding GitHub accounts and found that at least 111 names that had previously published servers had been renamed or deleted, and no longer belonged to any account.
Under those names, 145 live servers remained listed in the registry, with roughly 17,000 downloads per week. Because a server entry stays in the registry under the old name after a GitHub account is renamed or removed, anyone who registers the same username later would be able to publish new versions of those servers. The registry itself offers no way to tell that the new releases did not come from the original author.
As of the article's publication on 3 November 2026, no official fix or response had been reported, and the ownership risk for these io.github namespaces remained open. The researcher's piece appeared on DEV Community under the headline "Rename your GitHub account and your MCP servers stay in the official registry under your old name."
AI-generated from 1 reports · updated 3 days ago
- Heat index
- 25
- All sources
- 1
- All reports
- 1
- First seen
- 3 days ago
Reports on this story headlines open the original
A check of every io.github name in the official MCP registry against GitHub found at least 111 names that once published servers have since been renamed or deleted and now belong to no account. Those names still cover 145 live servers downloaded roughly 17,000 times a week, and anyone who registers the handle can publish new versions that the registry cannot distinguish from the original.
DEV Community · AIAI score 76
Other stories people are talking about
- Heat index 840OpenAI ships Images 2.6 with GIF and SVG output15 sources
- Heat index 675OpenAI says its cyber model pipeline confirmed 1,724 Linux kernel flaws and generated 948 privilege-escalation exploits11 sources
- Heat index 642RisingOpenAI GPT-5.6 Brings Major Agentic and Computer Use Upgrades13 sources
- Heat index 633RisingCat Wu, product lead for Claude Code, joins OpenAI9 sources
- Heat index 630NewSurgeOpenAI releases GPT-6 Cyber cybersecurity model7 sources
How is heat calculated?About the methodHide
Heat counts how many independent sources covered a story in the last 48 hours: one source counts once no matter how many posts it published, decaying with a 24-hour half-life. What ranks first is what many people are talking about.
This page aggregates public feeds. Headlines and summaries are machine-organized and remain the property of the original authors; verify important facts at the source. If you believe a headline or summary infringes your rights, email the contact address in the footer with the page URL and basis of your claim, and we will remove or replace it after review.
- Surge
- Discussion rising fast
- New
- First report within 6 hours
- Rising
- Still gathering discussion