mcp-quickstart-scaffolder

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI's --from-openapi option fetches an external OpenAPI spec at runtime (example URL: https://petstore3.swagger.io/api/v3/openapi.json) and uses that remote content to generate tool code that directly controls the server's behavior/instructions, so it is a runtime external dependency that can control prompts/code generation.