mapbox-mcp-runtime-patterns

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The examples start the MCP server at runtime using commands like subprocess.Popen(['npx', '@mapbox/mcp-server']) and spawn('npx', ['@mapbox/mcp-server']), which fetch and execute remote package code as a required self-hosted dependency (see https://github.com/mapbox/mcp-server), so this is a runtime external dependency that executes remote code.