mcp-management

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP client spawns configured commands at runtime (see .claude/.mcp.json examples) which explicitly run npx to fetch and execute remote packages such as "npx -y @modelcontextprotocol/server-memory" (and similar packages like @modelcontextprotocol/server-filesystem, @modelcontextprotocol/server-brave-search, @modelcontextprotocol/server-puppeteer, @modelcontextprotocol/server-fetch), so remote code is fetched and executed during skill runtime via the Stdio transport.