← All rules

mcp-scan rule

Upgrade available

upgrade-availableinfo

What mcp-scan saw

The package scanner compared a current version read from the server entry's own metadata.version against the latest dist-tag from the npm registry using semver.gt. It only fires when both parse as valid semver and latest is strictly greater. The fixRecommendation is upgraded to 'UPGRADE RECOMMENDED' when any advisory's fixed version is at or below latest.

Why it fires

It is the advisory-aware half of the vulnerability path: rather than always suggesting an upgrade, it checks whether the newest version is at or past a version that fixed a known advisory, and says so only then. That resolves-vulnerabilities check was previously inverted in the source and now points the right way.

When this is a false positive

  • The current version is read from server.metadata.version on the config entry, which the standard MCP config format does not carry. In practice this finding almost never fires, so its absence tells you nothing about whether an upgrade exists.
  • npx without a pin resolves latest at launch, which means you are already on latest and an upgrade finding would be about a version you do not run.
  • The comparison is against the latest dist-tag, so a prerelease or a next tag is not considered, and a package that publishes fixes on a maintenance branch will not surface them here.
  • The upgrade may be a major version with breaking changes. The finding says a newer version exists, not that it is compatible.

How to fix it

  1. Read the version pair in the finding text. It reports current and latest explicitly.
  2. Check whether the recommendation says UPGRADE RECOMMENDED. That wording means the scanner matched latest against an advisory's fixed version, which is a stronger reason than novelty.
  3. Pin the target version in the args array, for example npx -y package@1.4.0, rather than relying on npx resolving latest at launch.
  4. Read the package's changelog before a major bump. The rule compares semver, not compatibility.
  5. To suppress, add 'upgrade-available' to suppressRules in .mcp-scan.json.