Definition
Plain language
A tool that installs and keeps track of the outside software your program depends on.
As stated in the literature
System that resolves, downloads, and version-pins software dependencies; pinning by hash so an approved artifact can't be silently swapped is the analogy the paper draws for MCP tool definitions.
Also called: package managers
Why it matters: Without it you'd have to hunt down and update every piece of outside software by hand, and pinning versions keeps an approved piece from being quietly replaced with something malicious.
For example, when you install one library it might automatically fetch the dozen other pieces of software that library needs to run.
Heard on the show
“Pin the approved description by a fingerprint and re-prompt if it changes — that's just how package managers pin dependencies.”Episode 208 — The Blank Space in Your AI Approval Box That Isn't Empty