Deprecated MCP servers your AI agent may still install

Some npm packages for MCP servers are marked deprecated or sit in archived GitHub repos, yet they still install and complete an MCP handshake. An agent that copies a package name from training data can pull one of those packages with no client warning. Below are the 8 that still completed a handshake in our tests, plus Glow Labs' MCPhantom figures (theirs, not ours).

Short answer

Of the 299 MCP servers we list, 24 are deprecated or archived (19 with a registry deprecated flag, 19 with an archived GitHub repo; overlap → 24). Among those 24: 8 working (handshake completed), 7 auth-gated, 8 failed, 1 install-failed. The table below lists only the 8 still-working ones, ordered by GitHub stars.

Full list of all 24 deprecated or archived listings (every status): /deprecated/. Check a client config against our results: MCP config checker. Servers that stop at a credential check: needs API key or sign-in. Example still-working deprecated reference: Puppeteer (legacy).

Still-working deprecated MCP servers (8)

Rows are servers marked deprecated on npm or archived on GitHub but still passing our handshake test (data: scored.json), sorted by GitHub stars, most first. Deprecation note prefers the exact npm message in npm-deprecations.json when present. Replacement is shown only when that file names one with evidence.

Server	Package	Status	Deprecation note	Replacement	Last tested
Browser (agent-infra)	`@agent-infra/mcp-server-browser`	working (handshake completed)	archived GitHub repo archived (no registry message)	None identified	2026-11-10
Browserbase	`@browserbasehq/mcp-server-browserbase`	working (handshake completed)	deprecated+archived This package has moved to @browserbasehq/mcp	`@browserbasehq/mcp`	2026-11-10
AWS KB Retrieval (legacy reference)	`@modelcontextprotocol/server-aws-kb-retrieval`	working (handshake completed)	deprecated+archived Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.	None identified	2026-11-10
GitHub (legacy reference)	`@modelcontextprotocol/server-github`	working (handshake completed)	deprecated+archived Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.	GitHub MCP Server (official) (`github/github-mcp-server`)	2026-11-10
Postgres (legacy reference)	`@modelcontextprotocol/server-postgres`	working (handshake completed)	deprecated+archived Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.	None identified	2026-11-10
Puppeteer (legacy reference)	`@modelcontextprotocol/server-puppeteer`	working (handshake completed)	deprecated+archived Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.	None identified	2026-11-10
Redis (legacy reference)	`@modelcontextprotocol/server-redis`	working (handshake completed)	deprecated+archived Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.	None identified	2026-11-10
CircleCI (official)	`@circleci/mcp-server-circleci`	working (handshake completed)	deprecated Deprecated: use CircleCI's hosted MCP server or CircleCI CLI MCP instead. See https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/	None identified	2026-11-10

Handshake tests on these rows: 2026-11-10

Glow Labs MCPhantom (external research)

These figures are from Glow Labs' primary report, not from TestedMCP measurements. Source: Glow report, Nov 3, 2026 (author: Nadav Claude Cohen, Glow Labs).

Pattern name: MCPhantom.
In 98% of sessions where an agent set up a deprecated MCP server, the agent appeared to pick it from training data; in 2% the user asked for the deprecated package by name.
Glow's download table totals 17,352,267 npm downloads since 10 Jul 2025 across the listed deprecated @modelcontextprotocol reference packages (the same page also says “17M” in prose; we cite the exact table total).
Agent harnesses named in that report: Claude Code, Cursor, Codex CLI, Claude Cowork, Claude chat. Model providers named: Anthropic, OpenAI, xAI.
The report describes four high-severity vulns in archived Anthropic reference servers, including Puppeteer RCE via prompt injection; maintainers said those packages are unmaintained / no fix from that repo.

We do not invent other Glow figures. Our table above is only what we measured in scored.json.

What to do before an agent installs an MCP server

Prefer packages that are not deprecated or archived; see all deprecated listings.
When the npm deprecation message or our deprecation data names a replacement (for example Browserbase → @browserbasehq/mcp), use that package instead of the legacy name.
Paste your client config into the MCP config checker to flag packages we mark deprecated.
A completed handshake is not a maintenance promise: unmaintained packages can still answer initialize.

FAQ

Which deprecated MCP servers still install and complete a handshake?

Of the 24 deprecated or archived MCP servers we list, 8 still completed an MCP handshake in our tests. Ordered by GitHub stars: Browser (agent-infra) (@agent-infra/mcp-server-browser); Browserbase (@browserbasehq/mcp-server-browserbase); AWS KB Retrieval (legacy reference) (@modelcontextprotocol/server-aws-kb-retrieval); GitHub (legacy reference) (@modelcontextprotocol/server-github); Postgres (legacy reference) (@modelcontextprotocol/server-postgres); Puppeteer (legacy reference) (@modelcontextprotocol/server-puppeteer); Redis (legacy reference) (@modelcontextprotocol/server-redis); CircleCI (official) (@circleci/mcp-server-circleci). Last tested 2026-11-10.

How many deprecated MCP servers does TestedMCP track, and what are their statuses?

24 of 299 listings are deprecated or archived (19 with an npm/PyPI deprecated flag, 19 with an archived GitHub repo; overlap makes 24 unique). Among those 24: 8 working, 7 auth-gated, 8 failed, 1 install-failed.

What is MCPhantom?

MCPhantom is the name Glow Labs gave to the pattern where coding agents install deprecated MCP packages that still live in training data. According to Glow Labs (Glow report, Nov 3, 2026), agents appeared to pick the deprecated package from training data in 98% of sessions where a deprecated MCP server was set up, and the user asked for it by name in 2%. Glow's download table totals 17,352,267 npm downloads since 10 Jul 2025 across the listed deprecated @modelcontextprotocol reference packages. Those figures are Glow's research, not TestedMCP's.

Does a completed handshake mean a deprecated MCP server is fine to keep using?

No. A completed handshake only means the package still installed and answered MCP initialize/tools/list in our sandbox. It does not mean the package is maintained. Prefer a replacement when the npm deprecation message names one, check the registry message, and use the config checker before you ship a client config.

How we test: methodology. Data: scored.json (deprecation, archive, status, test date and star fields) and npm-deprecations.json. Related: Deprecated MCP servers · Config checker · Needs API key · Puppeteer (legacy).

Page data checked 2026-11-11 (UTC)