Corelight finds dependency drift in pinned MCP servers

Corelight researchers found that pinned Model Context Protocol servers can experience significant dependency drift when launcher tools resolve package dependencies dynamically from public registries like PyPI during environment rebuilds. In a lab environment, an MCP server configured to run a fixed release ran with 15 different dependency sets over five weeks, exposing user credentials to potential supply chain risks. Corelight recommends freezing configurations and keeping packages updated to mitigate these vulnerabilities. Open article →