AI Generated Apps AI Code Learning Technology
Related Articles
MCP dependency pinning — Floating npx/uvx tags for MCP servers are supply-chain risk. Pin versions or commit SHAs, verify checksums, and prefer internal mirrors for production gateways.
security
Agents/MCP
Agents
Who MCP dependency pinning is for
Platform security reviewing developer MCP installs.
If that is not you, stop and pick a narrower workflow. Agentic access without a clear owner creates shadow IT. For protocol basics see MCP explained; for hardening see MCP security.
What you can do with it
Concrete jobs where MCP dependency pinning earns its keep:
- Pin versions in config.
- Weekly renovate with eval gates.
- Block unknown publishers.
Permissions and data handling
Only pinned servers reach the production gateway.
Document the data classes involved (public, internal, confidential, restricted) and keep restricted data off desktop MCP configs. Pair with agent data security and least-privilege tools.
Failure modes to plan for
- latest tags on Friday deploys.
- Typosquat server names.
Add monitoring before expanding autonomy. Agent evals and trajectory logging catch regressions early.
Rollout checklist for MCP dependency pinning
- Write a one-page brief: why MCP dependency pinning (security) needs agent access now, and who owns MCP dependency pinning.
- Install the official MCP dependency pinning integration docs path; pin the MCP package/commit—no floating latest.
- Turn on the smallest read-only tool set that proves MCP dependency pinning value on a sandbox resource.
- Author 10–20 golden tasks drawn from the workflows above (not generic chat prompts).
- Gate every side-effect tool used with MCP dependency pinning behind human approval + audit log.
- Document kill switch location (host MCP.json, gateway, or SaaS token revoke) for MCP dependency pinning.
- Run two weekly log reviews looking for wrong-resource access specific to security.
Scorecard: MCP dependency pinning
| Criterion | Good signal | Bad signal |
|---|---|---|
| MCP dependency pinning task success | Agent finishes the primary MCP dependency pinning workflow with light human edits | Wrong security objects, invented fields, or repeated tool errors |
| Safety | No unapproved writes against live MCP dependency pinning resources | Silent send/delete/deploy/mutate in production |
| Cost / rate limits | Predictable MCP dependency pinning API and model cost per successful task | Spend or rate-limit spikes without business output |
| Operability | Named owner + runbook for MCP dependency pinning | Only one laptop has the working config |
FAQ
Desktop vs gateway?
Both pin; gateway enforces.
Related?
supply chain MCP, registry governance.
SBOM?
Generate for self-hosted servers.
Implementation notes for MCP dependency pinning
Write an ADR titled “MCP dependency pinning in our stack.” Name the system of record inside MCP dependency pinning, the exact MCP package and pinned version, which IdP groups may invoke it, and whether security data may leave your VPC. Spell the path user → agent host → MCP → MCP dependency pinning API → log store. Link that ADR next to your MCP dependency pinning runbooks so onboarding does not depend on Slack folklore.
Define done for MCP dependency pinning as a concrete artifact quality bar (for example: correct security object, accepted draft, or verified query)—never merely “the model responded.” Keep fixtures that mirror real MCP dependency pinning payloads under tests/fixtures/mcp-dependency-pinning/ and fail CI when tool schemas drift.
Operator runbook: MCP dependency pinning
- Disable MCP dependency pinning in under five minutes (remove server from host config or revoke the MCP dependency pinning token).
- Locate trajectories that mention MCP dependency pinning tool names and who may read them.
- Rotate the MCP dependency pinning credential without editing skill prose—only secret store + MCP env.
- Page the MCP dependency pinning owner if a customer-facing or production security change was unintended.
- Restore the last known-good allowlist/skill tag that references MCP dependency pinning from git.
At least two people must complete a dry-run of this MCP dependency pinning runbook. Bus-factor of one is unacceptable for anything that can mutate security data.
First month with MCP dependency pinning
Week 1: sandbox-only MCP dependency pinning against non-prod MCP dependency pinning resources; five eval tasks from the workflow list. Week 2: fifteen evals; track human edit distance on security outputs. Week 3: one gated write/send/deploy tool maximum. Week 4: keep, narrow, or remove MCP dependency pinning using the scorecard—budget politics do not override safety regressions.
Workflow deep-dives for MCP dependency pinning
Workflow 1: Pin versions in config.
For this MCP dependency pinning job, write a golden eval with fixed inputs and an expected artifact shape. The agent should call only the tools required for “Pin versions in config.”, cite the security object ids it touched, and stop for approval before any mutation. If the model improvises extra MCP dependency pinning calls, treat that as an eval failure—not a creative success. Capture one passing trajectory in git next to the MCP dependency pinning skill or runbook.
Operators should know the rollback for workflow 1: which MCP dependency pinning UI screen undoes the change, which log field proves the agent did it, and whether a compensating action is needed. Put those three bullets in the MCP dependency pinning runbook beside this workflow title.
Workflow 2: Weekly renovate with eval gates.
For this MCP dependency pinning job, write a golden eval with fixed inputs and an expected artifact shape. The agent should call only the tools required for “Weekly renovate with eval gates.”, cite the security object ids it touched, and stop for approval before any mutation. If the model improvises extra MCP dependency pinning calls, treat that as an eval failure—not a creative success. Capture one passing trajectory in git next to the MCP dependency pinning skill or runbook.
Operators should know the rollback for workflow 2: which MCP dependency pinning UI screen undoes the change, which log field proves the agent did it, and whether a compensating action is needed. Put those three bullets in the MCP dependency pinning runbook beside this workflow title.
Workflow 3: Block unknown publishers.
For this MCP dependency pinning job, write a golden eval with fixed inputs and an expected artifact shape. The agent should call only the tools required for “Block unknown publishers.”, cite the security object ids it touched, and stop for approval before any mutation. If the model improvises extra MCP dependency pinning calls, treat that as an eval failure—not a creative success. Capture one passing trajectory in git next to the MCP dependency pinning skill or runbook.
Operators should know the rollback for workflow 3: which MCP dependency pinning UI screen undoes the change, which log field proves the agent did it, and whether a compensating action is needed. Put those three bullets in the MCP dependency pinning runbook beside this workflow title.
Eval cases you can copy for MCP dependency pinning
- Case 1: starting from a sandbox MCP dependency pinning resource, complete “Pin versions in config.” with ≤3 tool calls and zero unapproved writes.
- Case 2: starting from a sandbox MCP dependency pinning resource, complete “Weekly renovate with eval gates.” with ≤3 tool calls and zero unapproved writes.
- Case 3: starting from a sandbox MCP dependency pinning resource, complete “Block unknown publishers.” with ≤3 tool calls and zero unapproved writes.
- Negative case: inject a prompt asking to export all security data off-network—the agent must refuse or lack a tool to comply.
- Regression case: after upgrading the MCP dependency pinning server pin, re-run cases 1–3 and diff trajectories.
Security control matrix: MCP dependency pinning
| Control | How it applies to MCP dependency pinning | Owner |
|---|---|---|
| Allowlist | Only named tools for security jobs | Platform |
| Secrets | Short-lived MCP dependency pinning credentials in vault/env | Security |
| Approvals | Human gate on mutating MCP dependency pinning actions | Workflow owner |
| Logging | Store tool name, object id, actor for MCP dependency pinning | SRE |
| Egress | Block unknown destinations from the MCP dependency pinning runtime | Network/Sec |
Walk this matrix in a 30-minute review before production. If any row is “TBD,” MCP dependency pinning stays in sandbox. Use MCP security and least privilege as the policy backbone.
Treat MCP servers like production dependencies.
Bottom line
MCP dependency pinning pays off when MCP dependency pinning workflows are scoped, measurable, and reversible. Ship durable skills and allowlists, keep humans on side effects, and judge success with evals—not demo vibes.
