> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Supply chain risks/dependency tampering

> MCP server uses software dependencies that may be malicious, compromised, or sourced without integrity verification.

MCP server uses software dependencies that may be malicious, compromised, or sourced without integrity verification.

## How to resolve

**Pin versions and require cryptographic signing**: Pin component versions to specific stable releases — avoid `latest` or floating version tags. Require cryptographic signing for SDKs, plugins, tool manifests, and container images. Validate signatures during installation and startup, and use content-addressable identifiers with cryptographic hashes for schema versions.

**Generate and maintain SBOMs**: Generate a Software Bill of Materials (SBOM) for each MCP server and plugin package using standard formats (SPDX, CycloneDX). Store SBOMs alongside deployments for auditing and incident response. Track versions, hashes, licenses, and provenance metadata for all components.

**Verify provenance and use approved registries**: Only consume packages from canonical organizations and official package registries. Use internal package mirrors or registries and block direct downloads from the public internet. Implement a dependency approval process that includes security review and vendor risk profiling for new packages.

**Scan dependencies and sandbox third-party plugins**: Apply software composition analysis (SCA) tools to detect known CVEs, malicious indicators, and poisoned transitive dependencies. Run third-party plugins in constrained environments (e.g., WASM, container isolation) with restricted filesystem and network access. Subscribe to security advisories and implement automated alerting for critical dependencies.

## Risk

**Governance/Compliance**

Dependency tampering vulnerabilities violate multiple security standards:

* **NIST SP 800-161 Rev.1 (Cybersecurity Supply Chain Risk Management):** Violates supply chain risk management practices by not verifying integrity, provenance, and security of software dependencies.
* **OWASP Top 10 for LLM Applications (LLM03:2025 - Supply Chain Vulnerabilities):** Enables supply chain attacks through compromised or tampered software dependencies used by the MCP server.
* **OWASP MCP Top 10 (MCP04:2025 - Software Supply Chain Attacks & Dependency Tampering):** Enables supply chain compromise through unvetted, pre-release, or tampered dependency packages.
* **NIST SSDF (Secure Software Development Framework):** Fails to verify third-party software components and ensure their integrity throughout the software development lifecycle.

**Security**

Supply chain attacks through software dependencies are particularly dangerous for MCP servers because these servers usually have privileged access to LLM applications, user data, and connected systems. A compromised dependency can introduce backdoors, exfiltrate data, or execute arbitrary code with the server's full privileges. Pre-release and commit-pinned dependencies bypass the stability and review guarantees of proper releases, increasing the risk of consuming untested or malicious code. Dependencies from personal accounts or non-canonical registries lack the organizational oversight that reduces tampering risk. Floating version tags like `latest` further undermine reproducibility, allowing automatic consumption of compromised versions without explicit approval.

## Explanation

The MCP server depends on software packages, plugins, or connectors that may be malicious, compromised, altered, or sourced without integrity verification. This includes pre-release or commit-pinned dependencies, packages from personal accounts or non-canonical registries, and dependencies with floating version tags that bypass reproducibility and stability guarantees.

## Specifications

**Trigger**

* MCP server scan detects pre-release, commit-pinned, or pseudo-version dependencies; packages from personal accounts, forks, or non-canonical registries; or floating version tags that bypass reproducibility guarantees

**Severity**

* HIGH

**Applies to**: MCP Server