Evidence · DiggingBeagle record
MCP server commit pinned but runtime dependencies drifted into 15 distinct environments across 19 launches/builds
Corelight research distinguishes top-level MCP source pinning from transitive runtime reproducibility; 19 launches/builds of the same pinned revision produced 15 different installed environments. The article documents drift, not attacker-controlled package substitution or a successful compromise.
- Source role
- primary disclosure
Evidence record
Corelight research distinguishes top-level MCP source pinning from transitive runtime reproducibility; 19 launches/builds of the same pinned revision produced 15 different installed environments. The article documents drift, not attacker-controlled package substitution or a successful compromise.
Claim-level citations (1)
- supportsPinning an MCP server commit did not pin its runtime dependencies: Corelight reported 15 different installed environments across 19 launches/builds of a pinned MCP server revision.
Corelight technical report, repeated pinned-server launch and dependency results