Function is_interpreter_command 

pub fn is_interpreter_command(command: &str) -> bool

Whether command launches an MCP server through an interpreter or package runner rather than being the server binary itself.

This decides whether a binary_sha256 pin means anything. For command: npx, args: @yawlabs/fetch-mcp the pin hashes npx — so it breaks on every unrelated Node upgrade while saying nothing at all about @yawlabs/fetch-mcp, which npx resolves and may fetch fresh at run time. Enforcing such a pin is both fragile and hollow; the honest report is that the server code is unprotected.

Real coverage for these needs a package-level pin (version + integrity), which is a different mechanism than hashing a file on disk.