Corelight: MCP servers can pull unreviewed packages with admin access
Original title: Corelight Warns AI Agents Can Silently Run Unreviewed Code With Privileged Access to Enterprise Networks
On one lab workstation, 19 rebuilds of one pinned MCP release produced 15 environments as transitive PyPI packages drifted.
Corelight's lab investigation found AI coding assistants launch Model Context Protocol servers with uvx, which resolves Python dependencies from PyPI on each rebuild even when a release or commit is pinned. Over five weeks, 23 of 69 packages on one server changed, and every MCP server started that way on the workstation drifted. Loaded code inherits the server's tokens, files and network access, and assistants start servers automatically. Corelight says this is a setup choice, not an MCP flaw, and recommends freezing environments with hash-pinned lock files.
Unconfirmed: Findings come from one lab workstation; Corelight says registry contact alone does not prove which versions were installed.
- Of 35 MCP servers reviewed, 23 recommended installs that resolve from a public registry.
- The lab host made over 1,600 connections in a week to 11 management systems.
- mcp-remote 0.0.5 through 0.1.15 has a CVSS 9.6 command-injection flaw fixed in 0.1.16.
- Five frozen servers started 457 times over two weeks kept identical package lists.
- Forty packages in one frozen community server were already older than the registry that day.
Impact: Unreviewed dependencies inherit API tokens, files and network paths
| Product | Affected | Fixed in |
|---|---|---|
| mcp-remote | 0.0.5 to 0.1.15 | 0.1.16 |
- 1.Pin to a commit, install from a hash-pinned lock file, and launch the server directly.
- 2.Turn off startup update checks and scope servers to read-only, short-lived credentials.
- 3.Upgrade mcp-remote to 0.1.16.
- Organizations
- Corelight
From the original article
3 min read at gbhackers.com
AI coding assistants can run MCP servers whose dependencies change without any configuration edit, and those servers often hold administrator credentials. The finding comes from a lab investigation that began as a blast-radius analysis using an AI agent. The agent noticed other AI agents on an administrator’s workstation.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.