← All rules

CTX-X006: MCP server not pinned to a version

warning · deterministic · autofix: suggested · ga

Why it matters

@latest or unpinned npx -y runs whatever was published most recently.

How to fix

Pin the package to an exact version.

Source

CWE-1357

Measured precision

22 findings in 11 of 210 benchmark repositories. 0 of 22 reviewed findings false. With fewer than 30 findings the rate is not yet established (95% upper bound 15%).

Suppress

<!-- ctx-ignore CTX-X006: reason -->