chatkit-python

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instantiates an MCPServerStreamableHttp pointing to http://localhost:8000/api/mcp at startup (params={"url": "http://localhost:8000/api/mcp", "timeout": 30"}) and uses that server as a required mcp_server for the Agent (cache_tools_list=True), which implies it fetches tool definitions at runtime that can control agent instructions and invoke remote tool execution.