Supply chain

Pin MCP server packages to exact versions instead of @latest

AgentArmor teamUpdated Oct 26, 20262 min read

You will replace floating @latest MCP server references in Cline and Continue with one specific version you have tested. This makes upgrades deliberate and rollbacks predictable.

Floating @latest config

Package args point to @latest or no version
Server code can change between editor sessions
Hard to tell which version broke a working setup

Pinned exact version

Package args name one version you have tested
Upgrades happen only when you change the number on purpose
Rollback means restoring one known version string

Why it matters

An @latest tag means the server package you run can change without any edit to your config. Cline 3.44.0 stopped detecting stdio servers, showing 'No MCP servers installed' and 'No connection found for server' errors, and the fix was released in a patch on Dec 17, 2025 (cline issue (opens external site)). When a server stops loading, you need to know which version worked before, so keep a known version string in your config.

Steps

Choose a version you have already run successfully. Run the configured npx command once in a terminal to confirm the server starts.
Open the MCP config for your client. In Cline, edit cline_mcp_settings.json. In Continue, edit the mcpServers section of your assistant config.
In the args, replace @latest or the unversioned package name with the one specific version number you chose. Change only the package part and leave the command and args structure as it is.
On Windows, if Continue reports that npx cannot be found, launch it through cmd with /c as in this example (continue issue (opens external site)):

yaml

mcpServers:
  - name: Server Memory
    command: "cmd"
    args:
      - /c
      - npx
      - "-y"
      - "@modelcontextprotocol/server-memory"

Reload the MCP servers or restart the editor. Confirm each server appears in the MCP panel and that one tool call returns a result.
Keep tokens out of the config file. One Continue example puts a GitHub token directly in the config, so pass a scoped token through an env block or an environment variable instead (continue issue (opens external site)).
When you upgrade, change the version number on purpose, then test in one project before you update the rest.

Common mistakes

Pinning the editor extension but leaving @latest in the MCP server args. The server package still updates on its own.
Assuming the servers still work after an editor update. Check the MCP panel after every Cline or Continue update.
Putting a personal access token directly in cline_mcp_settings.json, where it can end up in a shared repository.
Relying on the full path to npx as a fix without testing it. One Continue user reported that this did not help (continue issue (opens external site)).

Checklist

0 of 7 done

Replace every @latest MCP package reference with one exact version
Run each configured npx command once in a terminal to confirm it starts
Confirm each server appears in the Cline or Continue MCP panel after reload
Move tokens out of MCP config files into env vars or a scoped secret store
Keep cline_mcp_settings.json out of version control if it holds secrets
Record the pinned versions in your project notes for future upgrades
Test a version bump in one project before updating the rest

Sources

Was this guide useful?