A source-code hash can identify the top-level MCP server and still say little about the environment that executes it. Corelight studied server launches in which identical source revisions pulled changing transitive packages and produced different installed environments. The reported exercise observed 15 distinct runtime environments across 19 launches or…
Inspect the ClaimsCase · DiggingBeagle record
Pinning an MCP server commit did not pin its runtime dependencies
A source-code hash can identify the top-level MCP server and still say little about the environment that executes it. Corelight studied server launches in which identical source revisions pulled changing transitive packages and produced different installed environments.
Scope
Dependency-resolution research on MCP server reproducibility; no demonstrated attacker-triggered compromise in the reported sample.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
First-party research reports multiple dependency resolutions under a pinned source commit. No malicious substituted package or executed exploit is observed. An impact band is not assigned because the available Claims do not establish a comparable verified severity or quantified harm.
Assessed Nov 12, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R239-088-CORE · MCP server commit pinned but runtime dependencies drifted into 15 distinct environments across 19 launches/builds
At a glance
Reproducible agent tools require a reproducible runtime, not just a signed repository pointer.
Read the implicationsThe prevalence of actively malicious dependency substitutions and resulting committed tool effects is unknown.
Limits and uncertaintyFull account
A source-code hash can identify the top-level MCP server and still say little about the environment that executes it. Corelight studied server launches in which identical source revisions pulled changing transitive packages and produced different installed environments.
The reported exercise observed 15 distinct runtime environments across 19 launches or builds. This is evidence of reproducibility and supply-chain exposure, not a confirmed malicious dependency injection. The agent trust boundary depends on the complete executable closure: package versions, lockfiles, build images, tool declarations and permissions. Signing only the repository commit cannot make those downstream inputs immutable.
Reproducible agent tools require a reproducible runtime, not just a signed repository pointer.
The report demonstrates reproducibility drift, not a confirmed malicious dependency substitution. Signing the server commit cannot freeze package resolution, build images or the authority granted to a newly loaded dependency. To call a tool deployment reproducible, verification needs a pinned runtime closure and effect permissions, not only a repository SHA.
Mechanism and trust boundary
- 01
An operator pins an MCP server's own source revision.
- 02
The runtime resolves floating transitive packages or deployment artifacts independently of that revision.
- 03
The same top-level commit yields different executable dependency closures across launches.
Claims & evidence
CLM-R239-088-CORECorelight reported 15 different installed environments across 19 launches/builds of a pinned MCP server revision.supported
Basis: reported finding
- supportsMCP server commit pinned but runtime dependencies drifted into 15 distinct environments across 19 launches/buildsprimary disclosure
Corelight technical report, repeated pinned-server launch and dependency results
Implications
Reproducible agent tools require a reproducible runtime, not just a signed repository pointer.
Controls and mitigations
- Pin transitive dependencies and container digests, verify the deployment SBOM and isolate installed tools from credentials and sensitive filesystem paths.
Unknowns and contradictions
- The prevalence of actively malicious dependency substitutions and resulting committed tool effects is unknown.
Sources and citation
Material revision history
- Nov 12, 2026 · Published version · first publication · revision 241