Package Health/@modelcontextprotocol/sdk

@modelcontextprotocol/sdk

It includes a clear README, bundled TypeScript declarations, MIT licensing, and release notes for this version. CI is fully audited, though many action references are unpinned and the workflow audit found package installation outside a lockfile.

Latest 1.30.1

NPM

88%

Total Score

Maintainer Stability

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 8 workflows were analyzed with no untrusted checkouts or script injection; however, 29 of 45 action references are unpinned, and high-confidence adhoc package installation plus a trusted-publishing audit finding warrant workflow hygiene caution. The cache-poisoning finding is low confidence and does not independently carry much weight.

Vulnerabilities

Title	Versions	Severity
CVE-2026-25536 @modelcontextprotocol/sdk is vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in versions 1.10.0 - 1.25.3.	1.10.0 - 1.25.3	High
CVE-2026-0621 @modelcontextprotocol/sdk is vulnerable to Inefficient Regular Expression Complexity in versions 1.3.0 - 1.25.2.	1.3.0 - 1.25.2	High
CVE-2025-66414 @modelcontextprotocol/sdk is vulnerable to Reliance on Reverse DNS Resolution for a Security-Critical Action in versions 0.0.0 - 1.24.0.	0.0.0 - 1.24.0	High
AIKIDO-2025-10583 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @modelcontextprotocol/sdk is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 1.17.3.	0.0.1 - 1.17.3	Medium
AIKIDO-2025-10459 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @modelcontextprotocol/sdk is vulnerable to Insufficient Session Expiration in versions 1.6.0 - 1.15.0.	1.6.0 - 1.15.0	Medium