MCP Observatory
6m ago Tracked 59,449 Last 6m ago 24h 2,443

Supply chain

registry metadata reported

Supply chain: npm packages that run install-lifecycle scripts (code on install) or have been deprecated upstream, alongside ecosystem provenance coverage — review signals inferred from registry metadata, not verdicts.

provenance coverage 1580/4348 npm+pypi
  • with provenance 1580

36% of 4348 npm + PyPI servers carry a build-provenance attestation (recorded as present; signature not re-verified).

flagged servers 22 shown
  1. skim-mcp-server install hooks no provenance
    npm
  2. stellar-memory install hooks no provenance
    npm
  3. sweetrb/apple-mail-mcp install hooks
    github-only
  4. sweetrb/apple-notes-mcp install hooks
    npm
  5. syncable-dev/memtrace-public install hooks no provenance
    npm
  6. tada-mcp install hooks no provenance
    npm
  7. teampolarity/cosmos-mcp install hooks no provenance
    npm
  8. warden-ai install hooks no provenance
    npm
  9. warp-agent-mcp install hooks no provenance
    npm
  10. wazionapps/nexo install hooks no provenance
    npm
  11. wonderwhy-er/DesktopCommanderMCP install hooks
    npm
  12. wyrm-mcp install hooks no provenance
    npm
  13. yaver-cli install hooks no provenance
    npm
  14. @aimino/fast-html-mcp-server deprecated no provenance
    npm
  15. @dpf-it/mcp-server deprecated no provenance
    npm
  16. @hasna/mcp-harness deprecated no provenance
    npm
  17. @karanb192/reddit-buddy-mcp deprecated no provenance
    npm
  18. Credda-io/credda-mcp deprecated
    github-only
  19. SylphxAI/pdf-reader-mcp deprecated no provenance
    npm
  20. agora402 deprecated no provenance
    npm
  21. hedera-mcp-platform deprecated no provenance
    npm
  22. klyrune deprecated no provenance
    npm