MCP-002 Mutable git ref

An MCP server entry installs from a git source whose ref is a moving branch or missing. Branches can be force-pushed and tags retagged; only a commit SHA is immutable. Without one, the next host launch can run different code from the code you reviewed.

What Vulkro detects

An mcpServers[*] argument that parses as a git URL whose ref is not a commit SHA. Recognised forms:

npm #<ref>: git+https://github.com/vendor/repo#main
uvx / pip @<ref>: git+https://github.com/vendor/repo@main
the uvx --from git+<url> <pkg> pair (counted once, not twice)
no ref at all, treated as HEAD

Mutable: HEAD, main, master, trunk, develop, dev, and any tag (v1.0.0). Immutable: a full 40-character hex SHA, or a 7 to 12 character short SHA.

Severity High, confidence High. Evidence signal: mcp-server-mutable-git-ref, weight 0.8, source Pattern.

Non-compliant code

The first entry tracks main; the second has no ref (HEAD).

{
  "mcpServers": {
    "experimental": {
      "command": "npx",
      "args": ["git+https://github.com/vendor/mcp-server-experimental#main"]
    },
    "internal-tool": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/internal/mcp-tool", "mcp-tool"]
    }
  }
}

Compliant code

{
  "mcpServers": {
    "experimental": {
      "command": "npx",
      "args": ["git+https://github.com/vendor/mcp-server-experimental#a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"]
    },
    "internal-tool": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/internal/mcp-tool@a1b2c3d", "mcp-tool"]
    }
  }
}

How to fix

Replace the branch or tag with a commit SHA (full 40-character form preferred).
npm-style URL: append #<sha>. uvx --from: append @<sha> to the git URL.
Bump the SHA in a reviewed change when you want newer code.

What Vulkro detects​

Non-compliant code​

Compliant code​

How to fix​

References​

What Vulkro detects

Non-compliant code

Compliant code

How to fix

References