MCP Observatory
6m ago Tracked 59,449 Last 6m ago 24h 2,443

Supply chain

registry metadata reported

Supply chain: npm packages that run install-lifecycle scripts (code on install) or have been deprecated upstream, alongside ecosystem provenance coverage — review signals inferred from registry metadata, not verdicts.

provenance coverage 1580/4348 npm+pypi
  • with provenance 1580

36% of 4348 npm + PyPI servers carry a build-provenance attestation (recorded as present; signature not re-verified).

flagged servers 25 shown
  1. harness-mcp-v2 install hooks
    npm
  2. in-memoria install hooks no provenance
    npm
  3. instar install hooks
    npm
  4. kai-mcp install hooks no provenance
    npm
  5. kitepon/peertable install hooks no provenance
    github-only
  6. lidge-jun/cli-jaw install hooks
    github-only
  7. lidge-jun/ima2-gen install hooks
    github-only
  8. llm-checker install hooks no provenance
    npm
  9. local-mcp install hooks no provenance
    npm
  10. majiayu000/remem install hooks no provenance
    npm
  11. mcp-mermaid install hooks no provenance
    npm
  12. midsummer-sol install hooks no provenance
    npm
  13. minia2a-org/minia2a-mcp install hooks no provenance
    github-only
  14. mixdog install hooks
    npm
  15. mneme-ai install hooks no provenance
    npm
  16. mrrlin-dev/external-agents install hooks no provenance
    github-only
  17. mzxrai/mcp-webresearch install hooks no provenance
    npm
  18. nano-brain install hooks no provenance
    npm
  19. nuxs-capsule install hooks no provenance
    npm
  20. ooples/token-optimizer-mcp install hooks
    github-only
  21. overmind-mcp install hooks no provenance
    npm
  22. phonton-cli install hooks
    npm
  23. postmanlabs/postman-mcp-server install hooks
    npm
  24. settlemesh install hooks no provenance
    npm
  25. shieldcortex install hooks no provenance
    npm