docker-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). Yes — the Dockerfiles invoke remote installs/pulls during build (e.g., RUN pip install fastmcp mcp openai litellm which fetches packages from PyPI (implicit https://pypi.org) and COPY/--from pulls ghcr.io/astral-sh/uv:latest and base images like node:20-alpine / python:3.13-slim from registries), so required external content is fetched at runtime and will install/execute remote code.