fix: the package in package.json

[anupamme]

Summary

Fix high severity security issue in package.json.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	package.json:22
Assessment	Likely exploitable

Description: The package.json uses a caret (^) version constraint for the mcp-remote dependency, which allows automatic updates to newer minor and patch versions. This introduces supply chain risk as malicious or compromised versions could be automatically installed during npm install without explicit review or approval.

Evidence

Exploitation scenario: An attacker who compromises the mcp-remote npm package or its transitive dependencies could publish a malicious version (e.g., 0.1.44 with backdoor).

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js command-line tool - exploitation requires the attacker to control the arguments, input files or environment the tool is run with.

Changes

• package.json

Behavior Preservation

This change touches only dependency manifest (package.json); no source file in the repository is modified.

---

Automated security fix by OrbisAI Security