light-tool-selection

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs explicitly instruct runtime discovery and use of MCP servers (e.g., querying the registry API at https://registry.modelcontextprotocol.io/v0/servers and then starting servers via npx/uvx like npx -y @modelcontextprotocol/server-*), which will fetch and execute remote packages and expose external tools/resources that can directly control agent prompts/execution.