Package Health/@modelcontextprotocol/sdk

@modelcontextprotocol/sdk

Model Context Protocol implementation for TypeScript

Latest 1.32.1

NPM

88%

Total Score

healthy

Active maintenance, seven recent contributors, and npm provenance outweigh mostly routine workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All seven workflows were analyzed with no untrusted checkouts or script injections, and three use job-level or read-only permissions. However, 27 of 42 action references are unpinned, and the audit identified high-severity low-confidence cache-poisoning, high-confidence ad hoc package installation, and trusted-publishing findings; these are workflow hygiene concerns rather than evidence of an unsafe release by themselves.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-156139 New @modelcontextprotocol/sdk is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.1 - 1.31.0.	0.0.1 - 1.31.0	Medium
AIKIDO-2026-344432 New @modelcontextprotocol/sdk is vulnerable to Incorrect Authorization in versions 1.6.0 - 1.31.0.	1.6.0 - 1.31.0	Medium
AIKIDO-2026-365378 New @modelcontextprotocol/sdk is vulnerable to Missing Authorization in versions 1.24.0 - 1.31.0.	1.24.0 - 1.31.0	High
CVE-2026-104850 @modelcontextprotocol/sdk is vulnerable to Insufficient Verification of Data Authenticity in versions 1.12.0 - 1.31.0.	1.12.0 - 1.31.0	High
CVE-2026-25536 @modelcontextprotocol/sdk is vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in versions 1.10.0 - 1.25.3.	1.10.0 - 1.25.3	High