Repository study finds unpinned MCP dependencies and broad agent execution preapprovals

An AI coding agent is not just a language model. Its repository instructions, hook and settings files, skills and MCP server declarations determine what packages it starts, what commands are preapproved and what instructions are surfaced to the model. Benjamin Kapner and collaborators at Red Hat and Ben-Gurion University analyzed 3,171 public GitHub repositories: 2,660 assembled agent setups and 511 skill collections. The scanner and reviewers examined six categories, of which three involve security-relevant declaration choices.

After contextual review and a corrected interpretation of Claude Code permission semantics, 409 assembled setups (15.4%) contained at least one of: unpinned MCP package dependencies, broad execution grants or broad skill tool preapproval. Specifically, 260 setups (9.8%) contained unpinned MCP declarations, 67 (2.5%) contained broad execution settings, and 101 (3.8%) broad skill preapproval; these rows overlap. Among the 1,063 setups that actually had an MCP declaration, 260 (24.5%) were unpinned. Including three non-security configuration and specification categories raises the total to 475 setups (17.9%) and 35 of 511 skill collections (6.8%). These are sample proportions, not an internet-wide census.

A significant methodological correction is independently useful. The authors originally flagged wildcard find grants as arbitrary execution because the Unix utility can invoke another command. Claude Code documentation specifically excludes certain find operations from wildcard preapproval, so the team removed 62 incorrect findings after checking version-specific semantics. The mechanical re-derivation and scanner had agreed on the same wrong premise. Agreement of two scanners is therefore not enough unless their shared assumptions are tested against the actual client.

No credentials were shown stolen by these configurations. Six exploratory credential-to-network graph alerts did not independently establish an exfiltration path, and authors explicitly did not execute repository code during the corrected analysis. Runtime activation, user approvals, scope overrides, client versions, recall and actual exploitation are unknown. This work complements the existing context privilege escalation, DeepSeek Harness local-control-plane and Plugin4Shell Cases: they show specific authority or artifact-integrity mechanisms, while this study measures how frequently selected configuration declarations appear in its chosen repositories, without observing breaches.