Package Health/org.springdoc:springdoc-openapi-starter-common-mcp

org.springdoc:springdoc-openapi-starter-common-mcp

This release is usable but carries meaningful transparency and maturity concerns. It is a stable, non-deprecated Maven package with a small runtime dependency footprint, a license file, no install-time lifecycle scripts, and Maven PGP build provenance. However, it is only 147 days old with three releases, has no packaged README, tests, or changelog, and no source repository is declared, leaving maintenance activity, contributor depth, and repository hygiene unverifiable. I would consider it for use with normal dependency monitoring, but would prefer a release with clearer source backing and stronger published documentation before making it a critical dependency.

Latest 3.1.1

Maven

62%

Total Score

Dependencies

100

Maturity

Supply Chain

100

Attestations

100

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-543683 New springdoc-openapi-starter-common-mcp is vulnerable to Server-Side Request Forgery (SSRF) in versions 3.0.3 - 3.1.0.	3.0.3 - 3.1.0	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.springdoc:springdoc-openapi-starter-common Version 3.1.1	—	—
org.springframework.ai:spring-ai-mcp Version *	—	—
org.springframework:spring-web Version *	—	—
org.aspectj:aspectjweaver Version *	—	—