@modelcontextprotocol/ext-apps

Licensecaution

The package declares MIT and includes a license file, so it is licensed; the detected Apache-2.0, MIT, and CC-BY-4.0 text is broader than the declaration and merits a metadata caveat.

Repo toolingcaution

TypeScript, npm scripts, and esbuild provide a clear build toolchain; the absence of detected security scanning is a minor process gap, not evidence of abandonment.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkouts or script-injection findings, but all 47 action references are unpinned and three workflows grant top-level write permissions. The reported template-injection findings lack a dangerous trigger pairing here, while low-confidence cache findings and one low-severity ad hoc package install are hygiene concerns.