T08 · Insecure Dependencies
- Location
scripts/mcp_discover.py:121- Finding
Generated MCP configurations execute unpinned npm packages with automatic confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/mcp_discover.py:121-131
Additional Locations:scripts/mcp_discover.py:25-80,SKILL.md:44-49,references/registry.md:9-54,README.md:51-61
Vulnerability Type: Unpinned third-party dependencies and unattended package installation
Risk Level: MediumVulnerable Code
python def generate_config(selected_servers: List[str]) -> Dict: """生成 MCP 客户端配置""" config = {"mcpServers": {}} for server_name in selected_servers: server = KNOWN_SERVERS.get(server_name) if server: config["mcpServers"][server_name] = { "command": "npx", "args": ["-y", f"@modelcontextprotocol/server-{server_name}"] } return configThe package registry also contains installation commands following the same pattern:
python "filesystem": { "name": "filesystem", "description": "Secure file system access with configurable permissions", "url": "https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem", "install": "npx -y @modelcontextprotocol/server-filesystem", "category": "filesystem" },Technical Analysis
The generated MCP client configuration invokes npm packages through
npxwithout specifying exact package versions or integrity information. Consequently, package resolution occurs when the downstream MCP client executes the generated configuration, rather than being restricted to a version reviewed with this Skill.The
-yargument automatically accepts installation prompts. This reduces the opportunity for users to inspect the package name, resolved version, and installation source before package-controlled code runs.The Skill itself does not immediately execute these commands, and no evidence shows that the referenced packages are currently malicious. The vulnerability is a supply-chain exposure: if a package ...[truncated 1809 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin every recommended npm package to a reviewed exact version, for example:
python VERIFIED_PACKAGES = { "filesystem": { "package": "@modelcontextprotocol/server-filesystem", "version": "REVIEWED_EXACT_VERSION" } }Generate arguments using the exact package specifier:
python package = server["package"] version = server["version"] config["mcpServers"][server_name] = { "command": "npx", "args": [f"{package}@{version}"] } -
Remove
-yso package installation requires explicit user approval. Clearly warn users that accepting the installation executes third-party code. -
Prefer a separate, explicit installation workflow using a local project, a lockfile, and npm's integrity verification. Generated MCP configurations should then invoke an already installed, reviewed executable rather than dynamically downloading packages at client startup.
-
Maintain an allowlist that maps each server name to a fixed package name and version. Do not construct package identifiers from user input, even though the current
KNOWN_SERVERSlookup limits accepted names. -
Record package provenance, reviewed version, release date, and upstream repository for each entry. Re-review packages before updating pinned versions.
-
Document the permissions required by each MCP server and advise users to expose only the minimum necessary directories, credentials, databases, and network destinations.
-
Consider running third-party MCP servers in a restricted container or sandbox with a dedicated low-privilege account, minimal environment variables, read-only filesystems where practical, and outbound network controls.
-