T08 · Insecure Dependencies
Warning
- Location
- scripts/mcp_discover.py:121
- Finding
- Generated MCP configurations execute unpinned npm packages with automatic confirmation## Vulnerability Details **File Location**: `scripts/mcp_discover.py:121-131` **Additional Locations**: `scripts/mcp_discover.py:25-80`, `SKILL.md:44-49`, `references/registry.md:9-54`, `README.md:51-61` **Vulnerability Type**: Unpinned third-party dependencies and unattended package installation **Risk Level**: Medium ### Vulnerable Code ```python def generate_config(selected_servers: List[str]) -> Dict: """生成 MCP 客户端配置""" config = {"mcpServers": {}} for server_name in selected_servers: server = KNOWN_SERVERS.get(server_name) if server: config["mcpServers"][server_name] = { "command": "npx", "args": ["-y", f"@modelcontextprotocol/server-{server_name}"] } return config ``` The package registry also contains installation commands following the same pattern: ```python "filesystem": { "name": "filesystem", "description": "Secure file system access with configurable permissions", "url": "https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem", "install": "npx -y @modelcontextprotocol/server-filesystem", "category": "filesystem" }, ``` ### Technical Analysis The generated MCP client configuration invokes npm packages through `npx` without specifying exact package versions or integrity information. Consequently, package resolution occurs when the downstream MCP client executes the generated configuration, rather than being restricted to a version reviewed with this Skill. The `-y` argument automatically accepts installation prompts. This reduces the opportunity for users to inspect the package name, resolved version, and installation source before package-controlled code runs. The Skill itself does not immediately execute these commands, and no evidence shows that the referenced packages are currently malicious. The vulnerability is a supply-chain exposure: if a package ...[truncated 1809 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every recommended npm package to a reviewed exact version, for example: ```python VERIFIED_PACKAGES = { "filesystem": { "package": "@modelcontextprotocol/server-filesystem", "version": "REVIEWED_EXACT_VERSION" } } ``` Generate arguments using the exact package specifier: ```python package = server["package"] version = server["version"] config["mcpServers"][server_name] = { "command": "npx", "args": [f"{package}@{version}"] } ``` 2. Remove `-y` so package installation requires explicit user approval. Clearly warn users that accepting the installation executes third-party code. 3. Prefer a separate, explicit installation workflow using a local project, a lockfile, and npm's integrity verification. Generated MCP configurations should then invoke an already installed, reviewed executable rather than dynamically downloading packages at client startup. 4. Maintain an allowlist that maps each server name to a fixed package name and version. Do not construct package identifiers from user input, even though the current `KNOWN_SERVERS` lookup limits accepted names. 5. Record package provenance, reviewed version, release date, and upstream repository for each entry. Re-review packages before updating pinned versions. 6. Document the permissions required by each MCP server and advise users to expose only the minimum necessary directories, credentials, databases, and network destinations. 7. Consider running third-party MCP servers in a restricted container or sandbox with a dedicated low-privilege account, minimal environment variables, read-only filesystems where practical, and outbound network controls.