Skip to content
Get packs

MCP Dependency Review

Flags MCP config package references that could silently pull in newer, different code

Source Download skill
Repository
affaan-m/ECC
Stars
295,127
Licence
MIT
Files
2 files

What it does

When installed, the agent reviews the MCP configuration files in a project (such as .mcp.json or .cursor/mcp.json) and checks whether each package or Docker image reference is pinned to an exact version or digest. It reports references that could resolve to different code later, such as @latest, bare package names, or version ranges, and rates their risk. It reads the config as plain text only and is instructed not to run the MCP servers it finds.

Great for

  • Teams who approve shared MCP configuration files and want to catch unpinned package references before merging
  • Engineers adding a deterministic MCP config check to CI pipelines
  • Security reviewers auditing whether a previously approved MCP setup could drift to newer package code

Skip it if

  • Proving a package is malicious or vulnerable: the skill explicitly treats mutability alone as not proof of compromise, and it does not check package contents or provenance
  • Full supply-chain assurance: an exact version pin does not make transitive dependencies reproducible, so the skill's SAFE results are narrow
  • Reviewing machine-wide or home-directory MCP settings unless the user explicitly asks, since the skill is scoped to the requested repository

Try asking

  • “Review the .mcp.json in this repo for package references that use @latest or no version before I approve the change”
  • “Check our .cursor/mcp.json and .vscode/mcp.json for unpinned npx packages and Docker images without tags or digests”
  • “Add a static MCP config check to our CI that flags version ranges and mutable Python package selectors”
  • “Tell me whether our previously approved MCP config could silently resolve to newer package code”
Step-by-step guide: how to use MCP Dependency ReviewInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    mcp-dependency-review.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip mcp-dependency-review.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip mcp-dependency-review.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point the review at a specific repository or workspace, since the skill avoids scanning beyond the requested scope
  • Pin npm packages to exact versions and Docker images to @sha256 digests, and pair them with lockfiles for full reproducibility
  • Treat REVIEW results (local scripts, editable Python installs, URLs) as items needing a manual source check rather than as passes

What's inside

  • agents/openai.yaml
  • SKILL.md

Redistributed unmodified from affaan-m/ECC under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.