Unverified MCP Server Vendor is detected in an SCM Repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_357
Category - Subcategory	Pipeline Configuration - 3rd Party Services
Severity	MEDIUM

Impact

An MCP Server configured in the development environment could not be verified as published by the approved vendor listed in the Palo Alto Supply Chain Catalog. The server's package namespace, repository origin, or registry verification status does not match the expected vendor identity, indicating a potential typosquatting or supply-chain substitution risk.