Corelight research reveals dependency drift risk in pinned MCP servers impacting AI coding assistants
Corelight's Director of Technical Alliances, James Lagermann, discovered that MCP (Model Context Protocol) servers configured to run a fixed release can still experience significant dependency drift, running with multiple different sets of dependencies over weeks without configuration changes. MCP servers, which AI coding assistants use to interact with other tools and often hold user credentials, were found to have twenty-three out of sixty-nine packages change versions on a workstation, including critical libraries like cryptography and JSON Web Token. This behavior is due to their Python package launcher (uvx) not respecting pinned lock files, leading to fresh dependency resolution on every rebuild and frequent environment changes. Corelight audited 35 MCP servers and found 23 recommended installs pull fresh dependencies from public registries regularly, exposing them to risks like the June 2026 Shai-Hulud worm variant attack on PyPI targeting MCP packages. To mitigate this, Corelight tested freezing MCP server environments by pinning to commits and disabling updates, ensuring consistent package sets at the cost of aging dependencies, with nightly vulnerability reviews advised. Corelight notified affected maintainers, prompting updated security review processes and repackaging by at least one vendor. This issue represents a supply chain risk in AI assistant infrastructures, as unintended dependency updates can introduce malware or vulnerabilities without version changes in the servers themselves.
Linha do tempo
-
Corelight research reveals dependency drift risk in pinned MCP servers impacting AI coding assistants
ler a análise desta fonte ocultar
Corelight's Director of Technical Alliances, James Lagermann, discovered that MCP (Model Context Protocol) servers configured to run a fixed release can still experience significant dependency drift, running with multiple different sets of dependencies over weeks without configuration changes. MCP servers, which AI coding assistants use to interact with other tools and often hold user credentials, were found to have twenty-three out of sixty-nine packages change versions on a workstation, including critical libraries like cryptography and JSON Web Token. This behavior is due to their Python package launcher (uvx) not respecting pinned lock files, leading to fresh dependency resolution on every rebuild and frequent environment changes. Corelight audited 35 MCP servers and found 23 recommended installs pull fresh dependencies from public registries regularly, exposing them to risks like the June 2026 Shai-Hulud worm variant attack on PyPI targeting MCP packages. To mitigate this, Corelight tested freezing MCP server environments by pinning to commits and disabling updates, ensuring consistent package sets at the cost of aging dependencies, with nightly vulnerability reviews advised. Corelight notified affected maintainers, prompting updated security review processes and repackaging by at least one vendor. This issue represents a supply chain risk in AI assistant infrastructures, as unintended dependency updates can introduce malware or vulnerabilities without version changes in the servers themselves.