MCP-001 Unpinned npx / uvx registry install

An MCP server entry runs npx <pkg> or uvx <pkg> with no version pin, so the package resolves fresh on every host launch. A publisher takeover, a maintainer swap or a bad next release lands directly inside a process your AI client runs, with the host's filesystem and credential reach.

What Vulkro detects

An mcpServers[*] entry in any MCP host config with:

1. command of npx or uvx,
2. a first positional argument that is a registry package spec (not a local path or git URL), and
3. no version pin.

Pins recognised: npm-style for npx (pkg@1.2.3, @scope/pkg@1.2.3, pkg@^1.0.0, tags such as pkg@beta; a bare @scope/pkg is not pinned), and name==version for uvx (npm-style as a fallback). Local paths are skipped; git URLs belong to MCP-002.

Severity Medium, raised to High when the package has filesystem reach (name contains server-filesystem, filesystem-server, mcp-server-fs or server-fs). Confidence High. Evidence signal: mcp-server-unpinned-npx, weight 0.8, source Pattern.

Non-compliant code

Both entries re-resolve on every host launch.

{
  "mcpServers": {
    "fs": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-filesystem", "/Users/me/work"]
    },
    "github": { "command": "uvx", "args": ["mcp-server-github"] }
  }
}

Compliant code

{
  "mcpServers": {
    "fs": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-filesystem@2025.5.0", "/Users/me/work"]
    },
    "github": { "command": "uvx", "args": ["mcp-server-github==0.4.2"] }
  }
}

How to fix

• Add an explicit version: pkg@x.y.z or @scope/pkg@x.y.z for npm, pkg==x.y.z for uvx.
• Bump the pin in a reviewed change when you want a newer build.

References

• CWE-1357: Reliance on Insufficiently Trustworthy Component
• CWE-1104: Use of Unmaintained Third Party Components
• OWASP A08:2021 Software and Data Integrity Failures

See also: vulkro mcp-audit, MCP-006, Confidence model.