Skip to content

Back to the catalog

State of Dependency Management 2025 | Endor Labs
endorlabs.compaper

State of Dependency Management 2025 | Endor Labs

Endor Labs' 2025 State of Dependency Management report examines how AI coding agents and MCP servers add supply chain risk. Researchers analysed 10,663 GitHub MCP server repositories and tested AI-generated dependency recommendations across PyPI, npm, Maven and NuGet, finding agents import vulnerable or non-existent packages. MCP servers are immature: 75% are built by individuals, 41% lack license info, and 82% use sensitive APIs. The report advises treating AI-generated code as untrusted third-party input subject to code review, SAST/SCA and dependency governance.

TL;DR Endor Labs report on AI coding agents importing vulnerable or non-existent dependencies and on the immature MCP server ecosystem (10,663 repos analysed).
Open original ↗

Organisations named here

  • Henrik Plate

Technologies named here

  • AI coding agents
  • Endor Labs State of Dependency Management 2025 report
  • Model Context Protocol servers
  • SAST
  • SCA
  • Model Context Protocol
  • GitHub
  • PyPI
  • npm
  • Maven
  • NuGet

Techniques named here

  • Insecure AI-generated code

Related in Supply Chain