13:25
2026-09-24
blog.devgenius.io
ai-agents
Your AI coding tools run software you never pinned. Here is the lockfile.
Mcp-audit version 0.18.0 adds a lockfile for MCP servers, addressing unpinned npx dependencies that fetch whatever version the npm registry calls latest on every tool start, according to the tool's au…