fix(security): validate package spec before scanner source fetch (MCP-2442 P0)#672

Merged

Dumbris merged 2 commits into

mainfrom

sec/mcp-2442-validate-package-spec

Jun 15, 2026

Commits on Jun 15, 2026

fix(security): reject non-registry specs before package-source fetch
Dumbris
committed
fix(security): validate package-spec @-tail, close direct-reference bypass

Dumbris
and
Paperclip-Paperclip
committed