supply chain risk in ai tooling is going to be a real story soon

we are all installing random mcp servers and packages with broad permissions. one bad dependency with tool access is a very bad day. pin your deps and read what you install.