MCP Has a Supply Chain Problem

In 2018 the event-stream npm package got a malicious update that targeted a specific Bitcoin wallet. Millions of downloads. One compromised maintainer. MCP is heading down the same path, just faster. The config everyone has If you've used Claude Desktop, Cursor, or any MCP client, your config probably looks like this: { "mcpServers" : { "my-tool" : { "command" : "npx" , "args" : [ "-y" , "some-mcp-server" ] } } } That -y flag means "install without asking." No version pin. Every time your agent starts, it pulls whatever version is latest from npm. If the package gets compromised tomorrow, your agent runs the compromised version automatically. This is not theoretical. We found 502 MCP server configurations doing exactly this across the registries we monitor. What we scanned Aguara Watch crawls every major MCP registry: skills.sh, ClawHub, PulseMCP, mcp.so, LobeHub, Smithery, Glama. Over 42,000 tools. 148 detection rules. Incremental scans every 6 hours. Here's what the data shows. Patte