Working notes from the sharp end.

The `npx -y` in your MCP config is a standing order

A second scanner on a shared engine: what an audit of the MCP servers configured on my own machine turned up, why `npx -y` is a standing order you signed, and how the bedrock auditor's reporting engine became a second product in days rather than months.

MCP · SECURITY · SUPPLY-CHAIN · AI · NPM