mcp-client-security

Repo bus factorcaution

Two contributors were active, but one produced about 83% of recent commits. The organization-owned repository provides some handoff capacity, but contributor concentration remains a maintenance risk.

Repo toolingcaution

The project uses Maven or Gradle build tooling, but no security scanning tools were detected. The missing scanning automation is a modest transparency and maintenance gap, not evidence of abandonment.

Security policycaution

The repository has no published security policy. For a package implementing OAuth2 and MCP security functionality, this reduces transparency around vulnerability reporting and response.

Version stabilitycaution

Version 0.1.14 is not a stable major release, so APIs may still change. It is not marked as a prerelease, which partly offsets the maturity concern.

Workflow auditcaution

All six referenced GitHub Actions are unpinned, weakening build reproducibility. The audit found no untrusted checkouts, script injection, dangerous triggers, or other reported workflow findings, so this is a hygiene concern rather than a severe risk.