tmcp

Lifecycle scriptscaution

A prepublish lifecycle script runs during publishing, adding some supply-chain complexity, though it is not evidence of an install-time runtime action by consumers.

Maintainerscaution

Only one registry account can publish the package, which aligns with the single-contributor repository and leaves little publishing redundancy.

Repo bus factorcaution

One contributor made all 29 recent commits, creating a meaningful continuity risk despite the current activity level.

Repo toolingcaution

TypeScript build tooling is present, but no security scanning tools were detected, leaving a security-maintenance gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.