An agent can connect on its own if it already holds BURN_MCP_SERVER_TOKEN.Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
n/a
stability.changes, stability.rug_pulltool list unknown
dependencies50 · weight 15
pass
deps.known_vulnsno known advisory in 106 resolved packages
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
warn
deps.resolvablethe dependency graph of [email protected] resolved with errors, so advisories may be missing
Tool list unknown · checked 2026-10-20 11:08 UTC
Tool changes
No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
Dependencies
[email protected]npm105 dependencies, resolved with errors, so advisories may be missing · MCP SDK @modelcontextprotocol/sdk 1.30.1 · advisories checked 2026-10-19
advisory
severity
package
fixed in
GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.