Corelight: MCP server setups let dependencies change unnoticed

uvx rebuilt one MCP server into 15 dependency sets

Corelight found one MCP server launched with uvx, a one-step tool that downloads a Python package and runs it from a single configuration line. The launcher resolved dependencies from PyPI whenever it rebuilt the environment, so 23 of 69 packages changed versions beneath a release that appeared pinned.

The project had pinned seven direct dependencies and published a hash-pinned lock file, but the launcher installed from the package’s declared dependencies instead of that lock file. Its cache held 19 builds of the same release and commit over five weeks, producing 15 distinct environments.

Another commit-pinned server produced 17 distinct environments across 19 builds. Its MCP framework was two major versions ahead of the version in the project’s own lock file.

23 of 35 reviewed MCP servers fetched dependencies afresh

Corelight reviewed 35 MCP servers from two vendor catalogs and its own lab. It found that 23 had recommended installations that would resolve dependencies fresh from a public registry.

In several vendors’ official setup instructions, local MCP proxies started with npm’s one-step runner and a latest tag. That caused clients to request the newest version from the npm registry each time they started.

One proxy released six versions in one recent month, including four within 14 hours. Corelight said its testing showed that freezing five servers kept their installed package lists unchanged across 457 starts over two weeks.

MCP dependencies can reach tokens and management systems

Corelight said code in any dependency, including a package no one deliberately selected, runs with whatever access the server has. That includes API tokens in its environment, the user’s files and network paths reachable from the workstation.

The same telemetry recorded more than 1,600 connections in one week to 11 management systems. Those systems included the firewall, the SIEM and sensor management.

Corelight cited a 2025 critical command-injection flaw in a widely used MCP proxy with a CVSS score of 9.6. It said a malicious or intercepted server could trigger that flaw on the user’s machine.

Corelight recommended pinning servers to commits, installing from hash-pinned lock files, launching installed servers directly and disabling startup update checks.