npx package on a moving tag or version range

A moving tag such as @latest or @beta, or a range such as @^1, is not a pin: each launch can run different code.

medium npx-latest

Flagged

  5         "args": [
  6           "-y",
  7 >         "some-mcp@latest"
  8         ]
  9       }

Fix

Replace the tag with an exact version: "args": ["-y", "@modelcontextprotocol/server-filesystem@2025.8.21", "/path"].

{
  "mcpServers": {
    "s": {
      "command": "npx",
      "args": [
        "-y",
        "some-mcp@1.4.2"
      ]
    }
  }
}