SD-024 — MCP Auto-Installed Package Execution
SD-024 discloses that an MCP server in a repository's config starts by fetching and executing a package from a public registry — an npx, uvx, pipx or bunx command.
What it matches
An MCP server that installs and executes a package on start, so the config alone determines what code runs.
Why it matters
The config alone decides what code runs, and the package it names is resolved from the registry at start-up, so the version that executes is whatever the registry serves at that moment. It runs on the developer's machine, outside whatever sandboxing constrains the agent, with the environment the shell gives it. This is the ordinary and intended way to start an MCP server; the finding exists so a reader knows to look at the package rather than read the config as inert.
Example
json
{"mcpServers": {
"search": {"command": "npx", "args": ["-y", "@example/mcp-search"]}
}}Opening the repository fetches and runs that package, and no version is pinned.
How to fix it
Pin the package to an exact version, so the same config starts the same code twice, and review that version as you would any dependency. Where the server matters to the project, vendor the binary or install it as a normal dependency instead of fetching it at every start-up.
Known false positives
The common and intended npx/uvx invocation pattern. This rule reports on the transparency axis for exactly that reason: it is disclosure, not accusation.
Standards mapping
Prevalence
Pattern SD-024 was detected in 2 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.