[docs] Do not encourage downloading the MCP with npx -y and @latest #47211
Description
Related page
https://mui.com/material-ui/getting-started/mcp/
Kind of issue
Other
Issue description
I appreciate that this is somewhat common for MCP implementations at the moment due to the lack of good standards around it, but it would be preferable if - at the very least - it were clearly communicated that this has some risks associated with it in terms of auto-running the latest code at all times, in what is likely a privileged execution environment (e.g. usually claude or github copilot would have access to quite a bit of information).
Namely, the concern is if the package were compromised in the future, the recommended setup would make the user fairly vulnerable to that attack, and it may be a good idea to install the package in the user's repo directly to pick the version based on the lockfile.
Context
No response
Search keywords: mui, mcp, npx, security