Two thirds of package-based MCP servers in public configs have no fixed version

What the audit looked at

As dev.to reported, a team collected MCP configuration files from public GitHub repositories on November 7 and 8. MCP, the Model Context Protocol, is a standard for plugging tools and data sources into AI agents. A config file lists which tool servers the agent launches, and therefore which code runs on your machine.

The team searched for four common file types, used by Claude Desktop, Claude Code, Cursor and VS Code. That produced 12,398 files, 10,850 of them unique, and 10,659 defined at least one server. Together those files describe 32,223 servers.

Of those servers, 14,098 start from a package registry: 11,973 through npm and 2,125 through PyPI. For each, the team looked up the exact version that would run, checked it against the OSV vulnerability database, and scanned the entry for secrets and risky settings.

The authors note two limits. Public repos include tutorials and test projects, so not every file is a live setup. GitHub search also caps results, so this is a large sample rather than a full census.

What 'unpinned' means in practice

A pinned server names one exact release. An unpinned one says "give me the newest." In the audit, 9,465 of the 14,098 package-based servers, or 67%, fell into the second group. Commands such as npx -y some-mcp-server, or ones ending in @latest, download the current release at every launch.

Nobody reviews that code before it runs. If a publisher's account is compromised or a release goes wrong, every machine picks it up on its next restart. The authors tie this to a simple question: if something was approved last month and changed today, is it still approved? With an unpinned config, it was never approved in the first place.

The fix is a single edit. Add a version number after the package name, for example @playwright/mcp@0.0.84. Then upgrade on purpose, after reading what changed.

Retired servers and names that don't exist

Another 941 files rely on a package that npm marks as deprecated. In 819 of them, the package is one of the early sample servers from the MCP project, which were retired in May 2025 and will not get security fixes. The most common was the GitHub one, which appeared 580 times. GitHub now maintains its own server, and Microsoft's Playwright package covers what the old Puppeteer one did.

A further 638 files name packages that are not on the registry at all, covering 1,381 servers, so they simply fail to start. Many follow one pattern. The official fetch, git, sqlite and time servers are Python packages, but people (or their agents) guessed npm names by analogy.

Some guesses are harmless because only the official organization can publish under that scope. Others are not. 145 servers in 53 files use names under @anthropic/, but Anthropic publishes under @anthropic-ai. The first scope belongs to an unrelated organization, which could publish matching packages. Unscoped guesses can be registered by anyone.

When a wrong guess met malware

This is not hypothetical. In June 2026, Amazon Inspector flagged five malicious npm packages with names like mcp-server-fetch, mcp-server-git and mcp-server-redis. According to the advisories, the names were registered to catch install commands issued by AI coding agents.

One of them ran a script at install time that sent the machine's network name, the directory it ran from, its platform and its Node version to an outside server. Its author called it canary research, meaning a probe to see who falls in. GitHub's advisory says any machine that installed it should be treated as compromised.

npm swapped all five for empty placeholders on August 20. Yet 15 files in the sample still point at a replaced name, 13 of them at one of these five. Today they pull a harmless placeholder, but before the takedown the same line would have installed the malicious version.

Keys in files and smaller problems

The checker flagged 1,122 files for possible secrets, though many were placeholders or local test passwords. A stricter count, using only known token formats and ignoring anything that looked like an example, left 152 files with what appear to be real keys. These included 96 in OpenAI format, 26 Google API keys, 18 Anthropic keys and 23 GitHub tokens. The team did not test them or name the repos.

Smaller issues showed up too. 453 remote servers still use an older connection style the MCP spec replaced in March 2025. 74 servers send tokens over plain, unencrypted HTTP. 68 auto-approve tools whose names suggest they write, send or delete. 684 Docker-based servers use the latest tag or no tag.

Taken together, only 5,154 files, 48%, passed with no flags.