MCP Observatory
6m ago Tracked 59,449 Last 6m ago 24h 2,443

Supply chain

registry metadata reported

Supply chain: npm packages that run install-lifecycle scripts (code on install) or have been deprecated upstream, alongside ecosystem provenance coverage — review signals inferred from registry metadata, not verdicts.

provenance coverage 1580/4348 npm+pypi
  • with provenance 1580

36% of 4348 npm + PyPI servers carry a build-provenance attestation (recorded as present; signature not re-verified).

flagged servers 25 shown
  1. agentdb install hooks no provenance
    npm
  2. agentic-flow install hooks no provenance
    npm
  3. agenticmail/agenticmail install hooks no provenance
    npm
  4. agentvibes install hooks no provenance
    npm
  5. agnix install hooks no provenance
    npm
  6. aidevops install hooks
    npm
  7. ancoder-skill-cli install hooks no provenance
    npm
  8. antenna-fyi install hooks no provenance
    npm
  9. atagon-GmbH/kogiqa-mcp install hooks no provenance
    github-only
  10. borgmcp install hooks no provenance
    npm
  11. browser-devtools-mcp install hooks no provenance
    npm
  12. cachly-dev/cachly-mcp install hooks no provenance
    npm
  13. claude-all-config install hooks no provenance
    npm
  14. claude-code-session-manager install hooks no provenance
    npm
  15. codeam-cli install hooks no provenance
    npm
  16. context-mode install hooks no provenance
    npm
  17. cursor-memory install hooks no provenance
    npm
  18. cybara install hooks
    npm
  19. docdex install hooks
    npm
  20. edk2-opencode install hooks no provenance
    npm
  21. eric-cielo/moflo install hooks no provenance
    npm
  22. fetcher-mcp install hooks no provenance
    npm
  23. gitnexus install hooks
    npm
  24. great-cto install hooks no provenance
    npm
  25. grix-connector install hooks no provenance
    npm