Pinned MCP servers silently pulled new dependencies in Corelight’s tests, an MCP server supply chain risk for admins who hold ...