Bitkub MCP Package Re-Registration Exposes Agent Supply Chain Risk
The deeper point is that package-name continuity proves nothing — identity of the maintainer is what matters, and stale docs can silently redirect installs. Teams wiring agents to financial or exchange APIs should audit publisher identity before every upgrade and enforce limits in execution code rather than prompts. The six-point checklist is directly usable as a review template for any MCP deployment.
