Beyond Package Audits: MCP's Dangerous Dependency Blind Spot

MCP security audits face a critical blind spot: checking only the package surface misses 69 vulnerabilities hidden in installed dependency trees. Among 31 audited packages, 11 had compromised runtime trees with 54 unique vulnerabilities—including critical and high-severity issues—despite clean package-level scans. This reveals why operators need full supply chain scanning, not just package checks, to assess real deployment risk.