A
100/100 First Seen
Feb 18, 2026
Last Scanned
Feb 20, 2026
Findings
1
Score
100/100
LOW 1
Findings (1)
LOW
npx MCP server without version pin
L36 Detects MCP server configs using npx to run packages without version pinning
"command"
:
"npx" FIX
Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.
FP?
Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.