140 silent contract changes in the official MCP servers (and how to catch them)

1. Deadbugz -- the server that waits for call #3 (August 2026) Pillar Security documented an active campaign pushing a malicious MCP server (it calls itself "productivity-suite") through 23 GitHub pull requests opened within 74 minutes (Aug 10).