Provenance Record

News article, 1,016 words (range 400-1200), structured as Overview / What Glow Labs Reports / What the Public Record Shows / What We Don't Know, with a closing disclosure sentence. The article keeps Glow Labs' claims attributed to Help Net Security throughout, separates them from what the GitHub issue, the archive README and Datadog show, and states plainly that the Herald reproduced nothing. The title is 131 characters, under the 150-character guideline, so no title-length finding.

All four snapshots read from disk (gunzip -c, HTML to plain text); all four sha256 values recomputed from the decompressed content and match manifest.json; all four fetched with status 200 and no archive fallback; suspicious_patterns is null for all four, so no pattern-scanner finding and no override was needed. source-0.html.gz (Help Net Security, Mirko Zorz, Director of Content, dated November 3, 2026): CONFIRMED. Verified verbatim: 'the agent appears to have filled in the name from the model’s training data' (hedge 'appears' is Help Net Security's own wording); 98% / other 2% user asked by name; 'The research looked only at sessions where a deprecated server was installed or suggested.' (the article's 'not how often agents choose a deprecated server overall' is labelled the Herald's own reading and is a fair inference, not in the source); 'a deprecated Anthropic reference server from its training data'; Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat and models from Anthropic, OpenAI and xAI; four high-severity vulnerabilities, Puppeteer RCE via prompt injection ('that one permission stretches to cover the rest, so the harness lets it through'); other three not named (article says so); report 'closed as out of scope', maintainers 'replied that the server was archived in May 2025 and is unmaintained, so no fix will come from that repository', 'would look at marking the npm package deprecated', 'No exploitation has been seen yet, and no patch is coming either', 'the flaws have no CVEs'; 'more than 17.3 million times since July 2025' and five in npm's top MCP 100; EDR/SCA/inventory explanation; Cohen quote 'A lookup before install is not enough on its own' and the session description; Ophir Arie, Glow VP of R&D, 'The model’s memory is now a package manager with no deprecation feed'; npm removal rule (fewer than 300 downloads in the past week, single owner, no public dependents) and 'server-github had 185,239 downloads last week and has 6 owners'. The interviewed researcher is 'Nadav Claude Cohen, vulnerability researcher at Glow' in the source; the article reproduces that name exactly (unusual middle name, but it is the source's spelling). source-1.html.gz (GitHub issue #4785): CONFIRMED. Opened by BerkantACUN (a third-party user who says he maintains an MCP configuration scanner), createdAt 2026-09-09T12:44:25Z; table totals 214,369 (95,430 + 84,416 + 21,273 + 13,250 = 214,369, arithmetic checked); npm text 'Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.' and 'it names no replacement and no security status' verbatim; proposed npm deprecate rewrite; cliffhall, labelled Member, triage comment createdAt 2026-10-19T16:19Z ('Priority Low (total 4)', 'is a cheap maintainer action that would reach every installer' verbatim); comment 'Updated all but server-brave-search, for some reason I could not access it.' createdAt 2026-11-05T04:21Z and issue closed as completed the same day; the UTC labels in the article are correct. The text 'Glow' does not occur anywhere in the snapshot, so the article's statement that neither the comment nor the issue mentions Glow Labs is accurate. source-2.html.gz (servers-archived README): CONFIRMED. Heading 'Model Context Protocol servers (ARCHIVED)', 'NO SECURITY GUARANTEES ARE PROVIDED FOR THESE ARCHIVED SERVERS.', 'No security updates or bug fixes will be provided', and the archived list includes GitHub, PostgreSQL and Puppeteer. The README does not mention Anthropic; Anthropic attribution in the article comes only from Help Net Security and Datadog and the article says so. source-3.html.gz (Datadog Security Labs, Santiago Mola, Staff Software Engineer, published August 21, 2025): CONFIRMED. Quote 'We found a SQL injection vulnerability in Anthropic’s reference Postgres MCP server that allowed us to bypass the read-only restriction and execute arbitrary SQL statements.' verbatim; timeline 'May 29, 2025: Anthropic fixes the vulnerability in their git repository. @modelcontextprotocol/server-postgres v0.6.2 remains unpatched at NPM and Docker Hub.' (article's 'remains unpatched at NPM and Docker Hub' verbatim); about 21,000 weekly downloads. All direct quote marks in the article (18 quoted strings, counted across the body) were matched against the snapshots; the only differences are punctuation placement (a trailing comma inside the closing quote mark) and the backticks around server-brave-search, which are code formatting on GitHub. 'both/every/each/all' statements ('all four carry npm's generic text', 'every installer') are sourced: the issue says 'Every one of the four carries npm's generic default text'. Dates: no relative dates in the Herald's own voice; 'last week' and 'in the past week' occur only inside the source's quote or paraphrase of an npm rule. INDEPENDENCE: Help Net Security is an independent trade news outlet, though its Glow claims come from Glow's own research and a Glow interview (a vendor's research, relayed); the GitHub issue was opened by a third party but sits in the project's own tracker and includes a maintainer's comment, so it is partly independent and partly first-party; Datadog Security Labs is a security vendor's research blog (not a news outlet) and independent of the MCP project; the servers-archived README is the project's own page (first-party). Independent of the subject: 2 clear (Help Net Security, Datadog), 1 partial (issue reporter), 1 first-party (README). Category is News, so the Analysis source minimums do not apply. ALLOWLIST: helpnetsecurity.com (line 1131), securitylabs.datadoghq.com (line 1136) and github.com (line 1139) are all in config/source_allowlist.txt; glow.io is not cited. No allowlist addition made.

No fabricated or misattributed fact found. Points the writer asked to have checked: (1) Hedging: 'appear' / 'training data' in the title matches Help Net Security's 'appears to have filled in the name from the model’s training data'; Glow Labs is attributed, not asserted as fact. (2) The 98% figure is correctly limited to sessions where a deprecated server was installed or suggested, with the qualifier quoted; the 'overall rate' point is labelled the Herald's own. (3) 'No fix is coming for a reported Puppeteer flaw': this is sourced, not inferred. Help Net Security says the Glow Labs report was closed as out of scope and that the maintainers replied 'so no fix will come from that repository'; it also says 'no patch is coming either'; the archive README says 'No security updates or bug fixes will be provided'. Two limits: the maintainers' reply is known only through Help Net Security (no snapshot contains the report or the reply), and the sentence about the closed report follows the Puppeteer paragraph without naming Puppeteer again. The body attributes this correctly ('according to the same article'), but the headline's second clause is unattributed and so reads stronger than the single secondary source behind it; a clarification is filed. (4) Datadog's SQL injection description and dates are exact (fixed in Anthropic's git repository May 29, 2025; npm v0.6.2 unpatched; about 21,000 weekly downloads at writing). The article never says the Datadog flaw is one of Glow's four and flags that as unknown. (5) The server-github figures (185,239 per the Cohen quote; 84,416 on 9 September per the issue) are flagged as unreconciled; correct, and the article does not claim the two are comparable. (6) The GitHub issue timestamps are labelled UTC and match createdAt values. One imprecision: the sentence 'A separate thread in the MCP servers repository predates the Glow Labs report' is true of the Help Net Security article (November 3), but no source dates Glow Labs' report to the maintainers, so it could be read as a claim about that report; clarified. Observation, not an error: Help Net Security says the maintainers 'would look at marking the npm package deprecated', whereas the issue shows the four packages were already deprecated with npm's generic text before September 9; the article reports both without asserting they conflict, and the November 5 comment (three of four updated) is correctly left unexplained.

APPROVE_WITH_CORRECTIONS. Accurate, well-hedged, well-attributed news article; all numbers, names, dates and quotes verified against the snapshots, with two small scope clarifications recorded in a corrections file. Featured candidacy: 2 - notable supply-chain finding for a broad developer audience (17.3 million npm downloads of unpatched archived servers), though it is vendor research with no observed exploitation