State of Dependency Management 2025
Download the report
Executive Summary
The State of Dependency Management 2025 reveals how AI coding agents and Model Context Protocol (MCP) servers are introducing a new layer of software supply chain risk as AI becomes an integral part of modern software development.
As developers increasingly rely on AI tools to accelerate coding, Endor Labs researchers found that these agents not only produce insecure code but also import vulnerable or non-existent open-source dependencies at scale.
In this year’s edition, to get a comprehensive overview of the MCP server landscape, we analyzed 10,663 GitHub repositories implementing MCP servers and performed large-scale testing of AI-generated dependency recommendations across major ecosystems such as PyPI, npm, Maven, and NuGet.
49%
34%
1 in 5
3X
The research also highlights that while extending AI capabilities with tools show promise, the MCP ecosystem itself remains immature:
- 75% of MCP servers are built by individuals, often without enterprise-grade safeguards.
- 41% lack any license information, limiting corporate adoption.
- 82% of MCP servers use sensitive APIs that require careful security controls to avoid vulnerabilities.
Why This Matters
The report underscores a critical shift in modern AppSec: As AI coding agents become embedded in IDEs and development workflows, new types of dependencies are entering the software supply chain.
Unvetted AI-generated code and MCP integrations now represent new “links” in the dependency chain, expanding the attack surface beyond package managers or build pipelines.
Recommended Actions
Endor Labs recommends enterprises treat AI-generated code as untrusted third-party input, enforcing the same code review, SAST/SCA scanning, and dependency governance controls used for human development.
Organizations should:
About Endor Labs Research
Endor Labs’ Security Research team investigates how modern software is built—and how it breaks. Led by Henrik Plate, our team of six PhDs and security researchers is on a mission to help the industry understand and reduce risk across the entire software supply chain. From open-source dependency analysis to the rise of AI-generated code, Endor Labs research combines large-scale empirical data with hands-on experimentation to reveal how real development practices impact security outcomes. Each study aims to translate complex findings into practical guidance for engineering and AppSec teams, empowering organizations to build software that is both faster and safer by design.
Download Report
