[docs] Do not encourage downloading the MCP with `npx -y` and `@latest`
@hasdfa is already working on this.
Since Nov 10, 2025.
- Dominant language
- JavaScript
- Stars
- 99.1k
- Forks
- 32.5k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 106
Description
Related page
https://mui.com/material-ui/getting-started/mcp/
Kind of issue
Other
Issue description
I appreciate that this is somewhat common for MCP implementations at the moment due to the lack of good standards around it, but it would be preferable if - at the very least - it were clearly communicated that this has some risks associated with it in terms of auto-running the latest code at all times, in what is likely a privileged execution environment (e.g. usually claude or github copilot would have access to quite a bit of information).
Namely, the concern is if the package were compromised in the future, the recommended setup would make the user fairly vulnerable to that attack, and it may be a good idea to install the package in the user's repo directly to pick the version based on the lockfile.
Context
No response
Search keywords: mui, mcp, npx, security
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.