mcp-integration

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The document contains runtime configurations that fetch/execute remote code and connect to external MCP servers — e.g., the stdio example that runs "npx -y @modelcontextprotocol/server-filesystem" (which downloads and executes an npm package at runtime) and SSE/HTTP examples like "https://mcp.asana.com/sse" / "https://api.example.com/mcp" (URLs that the agent connects to at runtime to discover tools and receive/execute instructions), so these are runtime external dependencies that can execute code or control agent behavior.