AI add-on warnings this week: Claude Code plugins, MCP Inspector and the MCP SDKs
By AgentArmorHQ team. October 29, 2026.
If you use Claude Code, Cursor or any tool that connects to MCP servers (small programs that give an AI assistant new abilities), several fixes landed in the last two weeks. Here are seven, each with one thing to do now.
1. Claude Code could install a plugin's unreviewed code
Claude Code pinned each plugin to one exact commit (a fixed snapshot of its code) but never checked it got that snapshot. Someone who controlled the plugin's repository could create a branch named like the snapshot ID, and the installer took their branch instead. GitHub rates it high. It affects Claude Code before 2.1.179.
Do this now: update to 2.1.179 or later. Automatic updates already have the fix.
Source: GHSA-pq7j-f95f-qfcv (opens external site). Our incident page: plugin install could skip the pinned version.
2. MCP Inspector: nine advisories, two critical
MCP Inspector is a tool for testing MCP servers. On October 21 it got nine advisories. In the two critical ones, a malicious remote server can run commands on your computer, through the sign-in callback or just by opening its app. Three more hit 2.x, including a high one that runs code on Windows.
Do this now: on 1.x, update to 1.0.3. On 2.x, update to 2.12.0. Only connect Inspector to servers you trust.
Sources: critical 1 (opens external site), critical 2 (opens external site), 2.x code execution (opens external site) and all nine (opens external site).
3. The MCP TypeScript SDK: two fixes need extra steps
Many MCP servers and clients are built on this SDK. Five advisories landed on October 20 and 27: re-sent API keys on redirects, a server accepting tokens meant for another service (moderate), memory exhaustion (high), no request size limit (high), and tasks shared between clients (high). It affects anyone building on @modelcontextprotocol/sdk.
Do this now: on 1.x, upgrade to 1.32.0. Upgrading alone changes nothing for two of them. The token fix needs expectedResource set, and the memory fix needs maxToolInputElements set. Follow those two advisories. On 2.x, fixed versions differ by package.
Sources: redirects (opens external site), tokens (opens external site), memory (opens external site), request size (opens external site), tasks (opens external site). Our incident pages: redirects, tokens, memory, tasks.
4. The MCP Python SDK: the token fix has extra steps
The Python SDK (mcp on pip, versions up to 1.29.1 and 2.1.1) got a redirect fix and a token fix on October 27. The check that rejects tokens meant for other services is off by default. Turning it on with one setting makes every request fail with a 401 error.
Do this now: upgrade to 1.30.0 or 2.2.0. If your server uses bearer-token sign-in, follow the token advisory's steps in full.
Sources: redirects (opens external site) and tokens (opens external site). Our incident page: redirects.
5. Two Google Cloud MCP servers
Google's MCP Toolbox for Databases has a critical flaw in its Cloud Storage source (versions 1.2.0 through 1.4.0). An attacker with no account could send host files to an outside bucket or overwrite local files. Cloud Run MCP before 1.11.0 has a separate flaw that could expose source code. GitHub has not yet reviewed either.
Do this now: for Toolbox, use 1.5.0 or later and set both limits, allowedBuckets and allowedLocalRoot. Both allow everything by default. For Cloud Run MCP, upgrade to 1.11.0.
Sources: Toolbox (opens external site), 1.5.0 change (opens external site), Cloud Run MCP (opens external site).
6. Three small MCP servers with no fix listed
Three high-rated advisories on October 27 describe one mistake: the server puts text from the assistant straight into a shell command. Whoever controls that text, such as an email or a file name, can run commands. The servers are mcp-ffmpeg through 1.0.5, the ai-sdlc plugin's MCP server through 0.31.2 and the ATXP Gemini CLI extension through 1.0.0.
Do this now: search your MCP config for these names and remove any you find until a fixed version is listed.
Sources: mcp-ffmpeg (opens external site), ai-sdlc (opens external site) and ATXP (opens external site).
7. AWS MCP Server: fixed on AWS's side
On October 23, AWS published a bulletin about its AWS MCP Server. A weak check in the run_script tool let a signed-in user run code inside their own isolated session. AWS hosts the server and has fixed it.
Do this now: nothing. AWS says no customer action is needed.
Source: AWS bulletin 2026-149-AWS (opens external site).
Where this list comes from
We gather public reports every day from GitHub's advisory database, vendor bulletins and security news. We checked every item against the original on October 29 and left out anything we could not confirm.
Want to check an add-on before you install it? Our free check takes a package name or config.
What did you run into this week?
Did one of these hit you, or did we miss something? Tell us on our Community page. We will add confirmed reports to next week's list.