@modelcontextprotocol/sdk
Model Context Protocol implementation for TypeScript
88%
Total Score
healthy
Frequent releases, active contributors, and an organization-backed repository outweigh limited workflow hygiene concerns.
Health Score Breakdown
The package declares 17 runtime dependencies and 23 development dependencies, including zod, express, hono, jose, and cross-spawn.
All 7 workflows were analyzed with no untrusted checkouts or script injections, but release.yml installs a package outside a lockfile and publish.yml uses registry trusted publishing; the high-severity cache finding has low confidence.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-111768 @modelcontextprotocol/sdk is vulnerable to Allocation of Resources Without Limits or Throttling in versions 1.3.0 - 1.32.0. | 1.3.0 - 1.32.0 | High |
AIKIDO-2026-156139 @modelcontextprotocol/sdk is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.4.0 - 1.31.0. | 0.4.0 - 1.31.0 | Medium |
AIKIDO-2026-344432 @modelcontextprotocol/sdk is vulnerable to Incorrect Authorization in versions 1.6.0 - 1.31.0. | 1.6.0 - 1.31.0 | Medium |
AIKIDO-2026-365378 @modelcontextprotocol/sdk is vulnerable to Missing Authorization in versions 1.24.0 - 1.31.0. | 1.24.0 - 1.31.0 | High |
CVE-2026-104850 @modelcontextprotocol/sdk is vulnerable to Insufficient Verification of Data Authenticity in versions 1.12.0 - 1.31.0. | 1.12.0 - 1.31.0 | High |
Package versions
| Version | Published | Vulnerabilities |
|---|---|---|
| 1.32.2 | 23 Oct 2026 | 0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total |
| 1.32.1 | 5 Oct 2026 | 0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total |
| 1.32.0 | 2 Oct 2026 | 0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total |
| 1.31.0 | 28 Sept 2026 | 0 0 critical, 4 total 2 2 high, 4 total 2 2 medium, 4 total 0 0 low, 4 total |
| 1.30.1 | 23 Sept 2026 | 0 0 critical, 5 total 3 3 high, 5 total 2 2 medium, 5 total 0 0 low, 5 total |
| 1.30.0 | 27 Jul 2026 | 0 0 critical, 5 total 3 3 high, 5 total 2 2 medium, 5 total 0 0 low, 5 total |
| 1.29.0 | 30 Mar 2026 | 0 0 critical, 5 total 3 3 high, 5 total 2 2 medium, 5 total 0 0 low, 5 total |
| 1.28.0 | 25 Mar 2026 | 0 0 critical, 5 total 3 3 high, 5 total 2 2 medium, 5 total 0 0 low, 5 total |
| 1.27.1 | 24 Feb 2026 | 0 0 critical, 5 total 3 3 high, 5 total 2 2 medium, 5 total 0 0 low, 5 total |
| 1.27.0 | 16 Feb 2026 | 0 0 critical, 5 total 3 3 high, 5 total 2 2 medium, 5 total 0 0 low, 5 total |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ajv Version ^8.17.1 | — | — |
zod Version ^3.25 || ^4.0 | — | — |
cors Version ^2.8.5 | — | — |
hono Version ^4.11.4 | — | — |
jose Version ^6.1.3 | — | — |
Weekly Downloads
Info
- Last Published
- 17 days ago
- Created
- 1 year ago
- Unpacked Size
- 4.3 MB
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.