Unpinned MCP server launches can expose API keys, Corelight finds
Of 35 servers reviewed, 23 recommended installs pulled fresh registry dependencies; pinning the main package did not lock the rest.
58
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 11, 2026
- Last mentioned4h ago
Timeline
2 articles · newest firstCorelight: MCP servers can pull unreviewed packages with admin access
On one lab workstation, 19 rebuilds of one pinned MCP release produced 15 environments as transitive PyPI packages drifted.
52
Appears with
- Model Context Protocolproduct · 2
- Corelightorganization · 2
- Shai-Huludmalware · 1
- mcp-remoteproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.