MCP server declaration resolves code at run time
An MCP server is launched with `npx -y`, `uvx`, `bunx`, or a container image with no digest, or is reached over a remote transport. The code that gets a tool call today is not necessarily the code that got one yesterday, and there is no version in the repository to review.
medium likely agent workspace ASI ASI04 / CWE-1357
What it looks like
From .mcp.json in the fixture suite.
The fixture test asserts this finding.
How to fix it
Pin the version or the digest, and prefer a dependency in `devDependencies` over a run-time resolve. For a remote transport, state the trust decision in the config - a comment naming who runs the endpoint - rather than leaving it implicit.
"args": ["-y", "@scope/mcp-server@1.4.2"]The fix for your agent host
Choose the configuration format used by your host.
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain agent-mcp-unpinned-remote
explain prints the rule and fixes in the terminal. It does not
use the network.