uvx package without a version

uvx resolves the newest release at launch, so a compromised or buggy release runs the next time the client starts.

medium uvx-unpinned

Flagged

  4         "command": "uvx",
  5         "args": [
  6 >         "mcp-server-fetch"
  7         ]
  8       }

Fix

Pin an exact version: "args": ["mcp-server-fetch==2025.4.7"].

{
  "mcpServers": {
    "s": {
      "command": "uvx",
      "args": [
        "mcp-server-fetch==2025.4.7"
      ]
    }
  }
}