low
MCP server installs without asking (npx -y)
npx -y installs a package without a confirmation prompt, and the package isn't pinned.
Why it matters
A changed or typo-squatted package name runs silently.
How to fix it
Keep -y only together with an exact pinned version.
Before
{
"mcpServers": {
"memory": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/server-memory"
]
}
}
}After
{
"mcpServers": {
"memory": {
"command": "npx",
"args": [
"-y",
"@modelcontextprotocol/[email protected]"
]
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- Unpinned MCP server package or image
- MCP server container runs --privileged
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed