medium
Unpinned MCP server package or image
The server is launched with npx, uvx, pipx or docker without an exact version, so each start fetches the newest release.
Why it matters
If the package or its publisher account is compromised, the new code runs with the server's access the next time your client starts. You also can't tell which version you ran yesterday.
How to fix it
Pin an exact version ([email protected] for npm, name==1.2.3 for Python, image@sha256:... for Docker) and update deliberately after reading the changes.
Before
{
"mcpServers": {
"fetch": {
"command": "uvx",
"args": [
"mcp-server-fetch"
]
}
}
}After
{
"mcpServers": {
"fetch": {
"command": "uvx",
"args": [
"mcp-server-fetch==2025.4.7"
]
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- MCP server installs without asking (npx -y)
- MCP server container runs --privileged
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed