You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Cline/Continue users add MCP servers from a list that shows a name and a description. Nothing at that moment says whether the server is still maintained, whether its current release has an open advisory, or whether it runs a script at install time.
I measure that publicly at tashan.sh — public evidence only, nothing paid can change a score, no listings and no promoted slots. Of the npm-published MCP servers audited so far, about 75% ship with no build provenance (no attestation tying the tarball to the repo it points at), 199 run a script at install time, and two turned out to be in OSV's malicious-packages database.
There is a free, keyless, CORS-open endpoint if this is useful:
GET https://tashan.sh/v0.1/lookup?name= # one package, a few hundred bytes
GET https://tashan.sh/v0.1/search?q= # ranked matches
The response carries the score, what the score is not (it is not a security verdict), the advisory ids, and the licence terms for quoting it. An unmeasured package answers measured:false rather than 404, because "we have no evidence" is a real answer and shouldn't look like an outage.
No account, no key, no rate limit to negotiate, and no ask on my side — attribution if you feel like it. If the shape is wrong for you, tell me what shape you'd want and I'll add it.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Cline/Continue users add MCP servers from a list that shows a name and a description. Nothing at that moment says whether the server is still maintained, whether its current release has an open advisory, or whether it runs a script at install time.
I measure that publicly at tashan.sh — public evidence only, nothing paid can change a score, no listings and no promoted slots. Of the npm-published MCP servers audited so far, about 75% ship with no build provenance (no attestation tying the tarball to the repo it points at), 199 run a script at install time, and two turned out to be in OSV's malicious-packages database.
There is a free, keyless, CORS-open endpoint if this is useful:
GET https://tashan.sh/v0.1/lookup?name= # one package, a few hundred bytes
GET https://tashan.sh/v0.1/search?q= # ranked matches
The response carries the score, what the score is not (it is not a security verdict), the advisory ids, and the licence terms for quoting it. An unmeasured package answers measured:false rather than 404, because "we have no evidence" is a real answer and shouldn't look like an outage.
No account, no key, no rate limit to negotiate, and no ask on my side — attribution if you feel like it. If the shape is wrong for you, tell me what shape you'd want and I'll add it.
All reactions