{"slug": "your-pinned-mcp-server-may-not-be-as-pinned-as-you-think", "title": "Your pinned MCP server may not be as pinned as you think", "summary": "An MCP server configured to run one fixed release on an administrator's workstation ran with 15 different sets of dependencies over five weeks with its configuration untouched, according to James Lagermann, Director of Technical Alliances at Corelight, who found the drift in his company's lab. Twenty-three of the server's 69 packages changed versions, including the cryptography library, the JSON Web Token library and the MCP software development kit itself. The finding shows that pinning an MCP server's version does not pin its transitive dependencies, a supply-chain risk for AI coding assistants that rely on Model Context Protocol servers.", "body_md": "An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its configuration untouched. James Lagermann, Director of Technical Alliances at Corelight, found the drift in his company’s lab. Twenty-three of the server’s 69 packages changed versions, including the cryptography library, the JSON Web Token library and the MCP software development kit itself. MCP (Model Context Protocol) servers let AI coding assistants … [More](https://www.helpnetsecurity.com/2026/11/13/corelight-mcp-server-supply-chain/) \n\nThe post [Your pinned MCP server may not be as pinned as you think](https://www.helpnetsecurity.com/2026/11/13/corelight-mcp-server-supply-chain/) appeared first on [Help Net Security](https://www.helpnetsecurity.com).", "url": "https://wpnews.pro/news/your-pinned-mcp-server-may-not-be-as-pinned-as-you-think", "canonical_source": "https://www.helpnetsecurity.com/2026/11/13/corelight-mcp-server-supply-chain/", "published_at": "2026-11-13 05:30:22+00:00", "updated_at": "2026-11-13 05:51:53.838856+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "ai-safety", "developer-tools"], "entities": ["Corelight", "James Lagermann", "Model Context Protocol", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-pinned-mcp-server-may-not-be-as-pinned-as-you-think", "markdown": "https://wpnews.pro/news/your-pinned-mcp-server-may-not-be-as-pinned-as-you-think.md", "text": "https://wpnews.pro/news/your-pinned-mcp-server-may-not-be-as-pinned-as-you-think.txt", "jsonld": "https://wpnews.pro/news/your-pinned-mcp-server-may-not-be-as-pinned-as-you-think.jsonld"}}