Glow Labs reviewed real coding sessions in which a deprecated MCP server was installed or suggested. In 98% of them the agent appeared to choose the package from its training data. The pattern appeared across Claude Code, Cursor and Codex CLI. Deprecated packages have been downloaded from npm more than 17.3 million times since July 2025, and four high-severity flaws have no CVE. Teams should audit MCP configs for deprecated servers, approve one server per service and check npm deprecation status.
