@tmcp/transport-http

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing. This is a modest supply-chain and reproducibility concern, though it is not evidence of malicious behavior by itself.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer activity has no visible organizational handoff support.

Repo bus factorcaution

One contributor made all 29 recent commits, leaving maintenance highly concentrated and creating meaningful continuity risk.

Repo toolingcaution

The project uses TypeScript build tooling, but no security scanning tools were detected, leaving a security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about how vulnerabilities should be reported and handled.