OOpenfort MCP ServerOpenfort is an open source alternative to wallet infrastructure solutions, it supercharges your project with authentication, user management and payments. Openfort’s MCP Server is a plug-and-play solution that enhances AI assistants by enabling them to create projects, manage configurations, and query data automatically when building applications on Openfort's infrastructure.

mcp-so:openfort-mcp_Openfort

View source
A
100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

5

Score

100/100

LOW 5

Findings (5)

LOW
npx MCP server without version pin
L64

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx MCP server without version pin
L96

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx MCP server without version pin
L159

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx MCP server without version pin
L195

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx MCP server without version pin
L219

Detects MCP server configs using npx to run packages without version pinning

"command": "npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.