Anaconda MCP reaches general availability to fact-check coding agents

The problem: agents choose packages without the facts

According to Anaconda, coding agents now handle dependency work on data science and AI projects: a user describes what the project needs, and the agent picks packages, pins versions and runs the installer. The company says the agent makes those choices without access to key facts, such as which packages exist in conda, which versions solve together, which carry open vulnerabilities and which channels the organization has approved. It fills the gap from training data.

Anaconda gives two examples. A script imports cv2, and the agent tries to install cv2 instead of opencv. Or it pulls from conda-forge when the organization allows only main. The result, in the company's words, is that developers check the dependency work by hand or find the problem later in a failed build or an audit.

The post also points to the security side of invented package names. A peer reviewed document presented at USENIX Security 2025 found that across 16 code-generating models, 19.7% of the packages those models suggested did not exist. When prompts that had produced a fake name were rerun, 43% of those came back in all 10 attempts. The study covered PyPI and npm and used models from early 2024. Anaconda notes that repeated names are names an attacker can predict and register.

In January 2026, Aikido Security researcher Charlie Eriksen found that an LLM had merged two real npm packages, jscodeshift and react-codemod, into a nonexistent one called react-codeshift, and wrote it into a batch of generated agent skills. By the time Eriksen registered the empty name himself, 237 GitHub repositories were telling agents to install it, and agents kept downloading it afterward.

Four read-only tools and what changed since the beta

The remote server offers four tools: package facts and dependencies, curated Common Vulnerabilities and Exposures (CVE) data with versions that include fixes, the organization's channel and policy configuration, and community forum search. The agent still does the work, but it checks facts, vulnerabilities and policy before choosing. Anaconda says it builds and maintains about 20,000 conda packages across its main and main-x channels and curates their vulnerability data.

• package_info returns versions, dependency constraints, supported platforms, build variants, download counts and a CVE summary for one named package. It is available to all users with an Anaconda account.
• package_security returns severity, status, CVSS vector, CWE category, an Anaconda analyst's comment and a fixed version written as a conda MatchSpec for one exact package version. It requires a Business or Enterprise subscription. Only active and reported vulnerabilities are included; cleared, disputed and mitigated CVEs are excluded.
• org_config returns the organization's channels and policy configuration, so an agent can say which policy blocks a package. It also requires Business or Enterprise.
• search_forum searches the Anaconda community forum by keyword and is available to all users with an account.

During the beta, the tool ran locally and took actions on the user's machine. It now runs remotely at https://anaconda.com/api/mcp over streamable HTTP, and when an environment needs to change, the agent runs conda under the permission settings the user has configured. There is no local package to install or upgrade. Beta users are advised to remove the anaconda-mcp package.

Anaconda also ships a free agent Skill, Anaconda Intelligence, which tells the agent which tool to call and when, for example calling org_config at the start of a session.

Security scan and setup

Enkrypt AI, now part of Anaconda, researches security risks in MCP servers. According to the company, in two months the team scanned 268,000+ tools across 25,000 MCP servers and found 143,000+ vulnerabilities, affecting 73% of those servers. Before launch, the same team scanned Anaconda MCP and found no vulnerabilities.

Every tool requires authentication through an Anaconda account, and the server identifies the organization from that account. Without an organization, tools return results without policy information. Without a Business or Enterprise plan, policy_status and policy_detail return null, and org_config returns no_subscription.

The server works with any MCP client that supports remote servers, including Kilo, Claude Code, Cursor and Codex. Users can connect through the Anaconda CLI by running ana mcp setup, through the Kilo Marketplace inside VSCode and JetBrains, or by adding the server address to the agent's MCP configuration. Anaconda suggests testing it with questions such as "What versions of numpy are available?" or "What policies are applied to our channels?"

What it means for developers and platform teams

For developers, the agent proposes packages with Anaconda's data in hand: which packages exist in the channels they can use, what they depend on and which have open critical vulnerabilities. Anaconda says users still review what the agent proposes.

For teams that own package policy, the company cites advice from the US Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and their Five Eyes partners to maintain trusted registries of approved third-party components and restrict agents to allow-listed tools and versions. Organizations that manage Anaconda channels with policies in Package Security Manager already keep such a registry, and Anaconda MCP lets developers' agents read it. When a package is blocked, the agent can tell the developer which policy applies and what to request from the administrator.