Only .mcp.json was left outside the lock file — 91.8% of 110 MCP servers are unpinned, identified in 53 lines

However, the MCP servers defined in .mcp.json in the same repository sometimes ignore that lock file entirely.After ...