Model Context Protocol (MCP) has emerged as a practical standard for connecting LLM-based agents with external tools and services through MCP servers. Driven by the open-source community, the MCP ecosystem is rapidly expanding, resulting in a large and growing collection of third-party MCP servers. Accurately selecting MCP servers that satisfy functional requirements from many candidates, therefore, becomes an increasingly important problem. However, MCP server documents are often unstructured and exhibit ambiguous function semantics, making it difficult to align user requirements with server capabilities during retrieval. To address this issue, we propose MCP-Focus, a function-oriented document enhancement framework that produces retrieval-ready MCP server documentation via a multi-stage agentic pipeline for white-box code analysis and document generation. Specifically, MCP-Focus first extracts a comprehensive tool inventory with metadata, then refines tool-level descriptions grounded in each extracted tool's implementation, and finally aggregates the refined tool descriptions into a structured server-level overview as the retrieval document. To better evaluate MCP server retrieval, we construct a benchmark comprising 3k+ open-source MCP servers and human-guided queries that vary in semantic ambiguity, input-output specificity, and the number of involved function points. Experiments across multiple dense retrievers show that fine-tuning with MCP-Focus-enhanced documents consistently improves retrieval effectiveness over baseline document methods on multiple benchmarks. Code and data: https://github.com/JingWC/MCP-Focus.

With the rapid advancement of artificial intelligence, pre-trained models (PTMs) have become fundamental building blocks in modern software systems.Model hubs, serving as centralized repositories for these components, have emerged as critical infrastructure in the AI software ecosystem.While prior research has extensively studied typosquatting attacks in traditional package management systems like NPM and PyPI, the security implications of such naming-based vulnerabilities in AI model hubs remain largely unexplored.To fill this gap, we present the first large-scale empirical study on typosquatting threats within the Hugging Face ecosystem, one of the most widely-used open-source model communities.Our research examines three key components: models, datasets, and organizations.Through a systematic analysis of 1,020,755 models (compared against the top 100 most downloaded ones), 219,812 datasets (compared against the top 100 most trending ones), and 127,011 organizations, we discovered concerning patterns of typosquatting that could compromise software supply chain security.Specifically, we identified 1,574 potentially malicious squatting models, with 10.4% exhibiting suspicious and harmful characteristics.Our investigation of datasets revealed 625 cases of typosquatting, where 42.2% showed signs of intentional impersonation based on sampling.Additionally, among the organizations studied, 302 demonstrated squatting patterns that could lead to supply chain attacks, with 4.8% showing explicit malicious intent.These findings highlight the pressing need for better naming conventions and security governance mechanisms in AI model repositories to ensure reliable and secure software development practices.We have reported all identified suspicious resources to Hugging Face for further investigation and potential mitigation measures.