MCP server installed straight from a git repo or download link
HighAV-MCP-108Supply chainMCP config packNew in 2.0
What it finds
An MCP server is installed from a git URL or a download link instead of a published, pinned package version.
Why it matters
Whatever is on that branch or URL at launch time is what runs — with your AI's permissions. A pushed commit or swapped file changes the code with no review.
What an attacker could do: Anyone who can push to that repo or change that file controls code running on this machine.
How to fix it
Install a published package with an exact version, or pin the git URL to a full commit hash and review that commit.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MCP_SERVER_FROM_GIT_URL
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
- OWASP LLM Top 10
- LLM05 - Supply Chain Vulnerabilities
- NIST AI RMF
- GV-6.1, MG-3.1
- SOC 2
- CC8.1, CC9.2
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.