Skip to main content
MCP server uses software dependencies that may be malicious, compromised, or sourced without integrity verification.

​
How to resolve

Pin versions and require cryptographic signing: Pin component versions to specific stable releases — avoid latest or floating version tags. Require cryptographic signing for SDKs, plugins, tool manifests, and container images. Validate signatures during installation and startup, and use content-addressable identifiers with cryptographic hashes for schema versions. Generate and maintain SBOMs: Generate a Software Bill of Materials (SBOM) for each MCP server and plugin package using standard formats (SPDX, CycloneDX). Store SBOMs alongside deployments for auditing and incident response. Track versions, hashes, licenses, and provenance metadata for all components. Verify provenance and use approved registries: Only consume packages from canonical organizations and official package registries. Use internal package mirrors or registries and block direct downloads from the public internet. Implement a dependency approval process that includes security review and vendor risk profiling for new packages. Scan dependencies and sandbox third-party plugins: Apply software composition analysis (SCA) tools to detect known CVEs, malicious indicators, and poisoned transitive dependencies. Run third-party plugins in constrained environments (e.g., WASM, container isolation) with restricted filesystem and network access. Subscribe to security advisories and implement automated alerting for critical dependencies.

​
Risk

Governance/Compliance Dependency tampering vulnerabilities violate multiple security standards:
  • NIST SP 800-161 Rev.1 (Cybersecurity Supply Chain Risk Management): Violates supply chain risk management practices by not verifying integrity, provenance, and security of software dependencies.
  • OWASP Top 10 for LLM Applications (LLM03:2025 - Supply Chain Vulnerabilities): Enables supply chain attacks through compromised or tampered software dependencies used by the MCP server.
  • OWASP MCP Top 10 (MCP04:2025 - Software Supply Chain Attacks & Dependency Tampering): Enables supply chain compromise through unvetted, pre-release, or tampered dependency packages.
  • NIST SSDF (Secure Software Development Framework): Fails to verify third-party software components and ensure their integrity throughout the software development lifecycle.
Security Supply chain attacks through software dependencies are particularly dangerous for MCP servers because these servers usually have privileged access to LLM applications, user data, and connected systems. A compromised dependency can introduce backdoors, exfiltrate data, or execute arbitrary code with the server’s full privileges. Pre-release and commit-pinned dependencies bypass the stability and review guarantees of proper releases, increasing the risk of consuming untested or malicious code. Dependencies from personal accounts or non-canonical registries lack the organizational oversight that reduces tampering risk. Floating version tags like latest further undermine reproducibility, allowing automatic consumption of compromised versions without explicit approval.

​
Explanation

The MCP server depends on software packages, plugins, or connectors that may be malicious, compromised, altered, or sourced without integrity verification. This includes pre-release or commit-pinned dependencies, packages from personal accounts or non-canonical registries, and dependencies with floating version tags that bypass reproducibility and stability guarantees.

​
Specifications

Trigger
  • MCP server scan detects pre-release, commit-pinned, or pseudo-version dependencies; packages from personal accounts, forks, or non-canonical registries; or floating version tags that bypass reproducibility guarantees
Severity
  • HIGH
Applies to: MCP Server