MCP server installed without a pinned version
What it finds
An MCP server is launched with `npx -y` / `uvx` using a bare package name, so whatever version is newest gets downloaded and run on every start.
Why it matters
If that package is ever compromised or hijacked, the next agent restart silently runs the attacker's code — with the server's tool access.
What an attacker could do: A malicious package update would run automatically with every capability this MCP server grants.
How to fix it
Pin an exact version (for example @modelcontextprotocol/server-github@2025.4.8), review upgrades deliberately, and prefer vendored or lockfile-installed servers.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MCP_UNPINNED_SERVER
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM05 - Supply Chain Vulnerabilities, LLM07 - Insecure Plugin Design
- NIST AI RMF
- GV-4.1, MG-2.2
- SOC 2
- CC8.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.