github.com/modelcontextprotocol/servers at d73f99efbfd40c3aa1b61e88728b3d49fb52608f · examined 2026-09-05 15:47 UTCServed from cache
The chain of trust: breaks at agent config · amber holds a warning · dashed was not established
Some of what installing this would do is worth reading before you agree to it.
The written summary was skipped for this report. The findings below are the analysis; the summary is only prose over them.
Annotations: 6 findings, 6 distinct concerns
1
WARNING · agent-config / MCP server registration
The repository ships 1 MCP server registration. A harness that indexes a cloned working tree can pick these up without any install step being run.
.mcp.json
2
NOTE · agent-config / agent instruction file
The repository ships 2 agent instruction files. A harness that indexes a cloned working tree can pick these up without any install step being run.
CLAUDE.md, src/everything/AGENTS.md
3
CLEAN · unauditable-surface / census
Every one of the 156 files in the repository is readable text.
file listing at the analysed commit
4
CLEAN · install-path / lifecycle-scripts
The package manifest declares no preinstall, install, postinstall or prepare script, so a package manager install does not execute code from this package.
package.json scripts
5
CLEAN · trust-root / activity
The last push was 3 days ago (2026-09-03).
GitHub repository pushed_at field
6
CLEAN · trust-root / concentration
Among the 100 most active contributors, the busiest (olaservo) accounts for about 21% of commits.
GitHub contributors API, first page
Unsurveyed: declared out of scope
Hatched = not measured
OpenSSF Scorecard has no published result for this repository, so its maintenance-hygiene score is not shown.
Nothing was executed. The installer was not run, the package was not installed, and no binary was launched, so every statement here is about what the code says it does rather than what it did.
Install scripts hosted outside this repository were not fetched. Only scripts committed to the repository itself are read.
Declared limits are as load-bearing as findings: this is the difference between a report and a scanner that implies completeness.
Target
modelcontextprotocol/servers
Revision
d73f99e
Files listed / read
156 / 5 · 0 executed
Method
read one at a time over HTTPS. Nothing cloned, extracted, installed or executed
Generated
2026-09-05 15:47:13 UTC · served from cache
Verdict
arithmetic over distinct concerns, recomputable by anyone