T08 · Insecure Dependencies
- Location
scripts/mcp_discover.py:120- Finding
Generated MCP configurations execute unpinned npm packages without confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/mcp_discover.py:120-122
Supporting Locations:scripts/mcp_discover.py:28-84,SKILL.md:44-51,references/registry.md:9-48,references/registry.md:72-81,README.md:47-58
Vulnerability Type: Unsafe use of unpinned third-party dependencies
Risk Level: MediumVulnerable Code
python config["mcpServers"][server_name] = { "command": "npx", "args": ["-y", f"@modelcontextprotocol/server-{server_name}"] }The hard-coded registry also recommends the same installation pattern, for example:
python "filesystem": { "name": "filesystem", "description": "Secure file system access with configurable permissions", "url": "https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem", "install": "npx -y @modelcontextprotocol/server-filesystem", "category": "filesystem" },Technical Analysis
The configuration generator emits commands that use
npx -yto retrieve and execute npm packages without a pinned version, integrity hash, lockfile, publisher verification, or interactive confirmation. The-yoption automatically accepts installation prompts.Consequently, the code reviewed during the audit is not necessarily the code executed later. Package resolution occurs when the generated MCP configuration is launched and may select a newer, compromised, transferred, or otherwise unexpected package release. The Skill does not verify that each package exists, is still maintained by the expected publisher, or corresponds to the repository URL shown in its local catalog.
This behavior is especially sensitive because the suggested MCP servers may be granted access to files, GitHub credentials, databases, browser sessions, network resources, or persistent memory. Package retrieval is relevant to the Skill's installation workflow, but automatic execution of mutable versions exceeds the minimum privil ...[truncated 1589 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every approved MCP package to an explicitly reviewed version, such as
@modelcontextprotocol/server-filesystem@X.Y.Z. - Maintain a lockfile or trusted manifest containing expected package names, versions, publishers, source repositories, and integrity hashes.
- Verify downloaded package integrity before execution and reject versions absent from the approved manifest.
- Avoid
npx -yin generated configurations. Separate configuration generation from installation and require explicit user confirmation before retrieving or executing packages. - Validate that each package is published by the expected organization and maps to the repository displayed by the Skill.
- Run MCP servers with least privilege, including restricted filesystem paths, narrowly scoped tokens, read-only database accounts where possible, minimal environment variables, and constrained network access.
- Warn users that generated server entries execute third-party software and identify the exact package version that will run.
- Periodically review pinned versions and update them through a controlled security-review process rather than automatically selecting the newest release.
- Pin every approved MCP package to an explicitly reviewed version, such as