Tech Stack & Credits
The software, data sources, and decisions behind the MCP Observatory.
Architecture
Three Node ≥22 processes sharing one SQLite WAL file — an Astro 7 SSR web server, a separate background worker, and a stateless code-scan sidecar. The worker is the sole writer; a busy or restarting worker never stalls the page; requests keep serving from SQLite while it recovers. The worker only resolves each artifact's URL and hands it to the scanner, which downloads, unpacks and runs the whole static pass — line-level analysis plus Semgrep taint rules — in its own container, so a heavy scan can never starve the worker's event loop. The live event stream runs over SSE via an in-memory broker backed by a SQLite outbox, so the web process never writes to the database.
- Astro 7 SSR · Node standalone
- Node worker 10 pollers · 12 jobs
- better-sqlite3 WAL · shared db
- TypeScript 6 strict · no UI framework
- SSE in-memory broker · SQLite outbox
- Docker Compose three services · /data volume
Design
Self-hosted, used for all data presentation and inline code. The phosphor-green palette keeps the terminal aesthetic without sacrificing readability. Islands are vanilla TypeScript — no React, Vue, or Svelte anywhere in the tree.
Display
Toggle the experimental CRT scanline effect.
Credits & Upstreams
Data sources
- npm registry
- PyPI
- GitHub API — topics, repos, advisories
- Smithery — directory + capability enrichment
- mcp.so — community listing
- Official MCP Registry
- OSV.dev — vulnerability database
- FIRST EPSS — exploit prediction scoring
Runtime
- Astro 7
- better-sqlite3
- esbuild — static analysis AST + worker bundler
- Pino — structured JSON logging
- Semgrep — taint analysis (runs in the isolated code-scan sidecar)
- JetBrains Mono — Apache 2.0
License
The observatory software is released under the MIT License. All upstream data remains subject to each source's own terms. Live polling status is on the feeds page; how data is collected and scored is on the methodology page.