JVM dependency intelligence for AI assistants via Maven Central
Risky behavior the analysis could not rule out.
The MCP server manifest launches a mutable, unpinned Docker image tag (:latest), so the code executed at runtime can change without any change to this repository.
"identifier": "docker.io/arvindand/maven-tools-mcp:latest"
The manifest launch identifier is an unpinned :latest OCI image, and the detector confirms it. The pinned official-registry carve-out does not apply.
Default config enables an outbound MCP client to the third-party https://mcp.context7.com/ and re-exports its tools, although an adjacent comment says no external calls are made and the server is declared as a Maven Central dependency lookup tool; an optional API key is also forwarded.
url: https://mcp.context7.com/
The default config enables an outbound client to third-party mcp.context7.com and re-exports its tools, while an adjacent comment says no external calls are made. That contradicts the declared behavior and is not a core-capability carve-out.
The agent spawns an unpinned Docker image tag (arvindand/maven-tools-mcp:latest) as its MCP tool server, so the code executed at runtime is mutable.
"args": ["run", "-i", "--rm", "arvindand/maven-tools-mcp:latest"],
The agent runs a mutable :latest Docker tag with no pin or mitigation, so the executed code can change without any repository change. Spawning the container is declared, but its mutability is not.
The direct MCP client spawns a Docker container from the mutable ':latest' tag of arvindand/maven-tools-mcp, so whatever image is currently published runs with stdio access to the agent.
STDIO_COMMAND = ["docker", "run", "-i", "--rm", "arvindand/maven-tools-mcp:latest"]
The direct client spawns the mutable :latest tag via a subprocess with piped stdio and nothing pins it; no mitigation or carve-out applies.
Candidates the review stage examined and rejected, kept for transparency.
The agent's Copilot SDK client auto-approves all MCP tool permission requests for unattended CI use, bypassing per-call user confirmation; this is consistent with the agent's declared CI purpose but is a broad permission.
# Auto-approve all MCP tool permission requests (unattended CI agent)
Auto-approval is openly declared in the module docstring and an inline comment as the intended behavior of an unattended CI agent, and it is a broad-permission setting rather than concealed or undeclared behavior.
Server config states tool responses embed guidance hints steering the LLM to call separate Context7 tools, conditioning other tool use (default enabled, documented, can be disabled).
tools include intelligent search suggestions to help LLMs effectively use Context7 tools for migration guidance and upgrade strategies
This is an openly documented, toggleable config property describing guidance hints. It contains no concealed instruction or coercive directive, so the behavior is declared and no chain to the agent exists.
Parts of the artifact the static analysis could not fully examine.
no_dataflow_for_batch batch file: string-literal extraction onlyno_dataflow_for_batch batch file: string-literal extraction onlyno_dataflow_for_batch batch file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction onlyno_dataflow_for_java java file: string-literal extraction only