security
Security
Every MCP risk signal in one place — CVEs, tool safety, drift, naming, licenses. Heuristic: review signals, not verdicts. New here? The Risk tab gives an at-a-glance composite grade per server; the Code Analysis tab shows what the static scanner found in published source.
91 CRITICAL
7986 HIGH
2858 MEDIUM
4914 LOW
16 NONE
Supply chain: npm packages that run install-lifecycle scripts (code on install) or have been deprecated upstream, alongside ecosystem provenance coverage — review signals inferred from registry metadata, not verdicts.
- with provenance 216
26% of 817 npm + PyPI servers carry a build-provenance attestation (recorded as present; signature not re-verified).
- @aashari/mcp-server-atlassian-bitbucket install hooks
- @aashari/mcp-server-atlassian-confluence install hooks no provenance
- @aashari/mcp-server-atlassian-jira install hooks no provenance
- @aerostack/gateway install hooks no provenance
- @agentprojectcontext/apx install hooks no provenance
- @ainative/cody-cli install hooks no provenance
- @aionlabsai/aion install hooks no provenance
- @askexenow/exe-os install hooks no provenance
- @azure/mcp install hooks no provenance
- @bangdao-ai/acw-tools install hooks no provenance
- @bike4mind/cli install hooks no provenance
- @comment-io/cli install hooks no provenance
- @drawio/mcp install hooks no provenance
- @emend-ai/utim install hooks no provenance
- @hasna/connectors install hooks no provenance
- @hasna/machines install hooks no provenance
- @hasna/todos install hooks no provenance
- @henkey/postgres-mcp-server install hooks no provenance
- @ironbee-ai/devtools install hooks no provenance
- @joecwales/cartographer-mcp install hooks no provenance
- @mapbox/mcp-server install hooks no provenance
- @orionops/cli install hooks no provenance
- @oxis-dev/tessra install hooks no provenance
- @postman/postman-mcp-server install hooks
- @proggarapsody/bitbottle install hooks