armandsar/laravel-mcp-documentation-generator

Maintainerscaution

The registry lists one publisher account. Because the repository is owned by the same individual rather than an organization, this indicates a limited maintainer base and higher bus-factor risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This weakens evidence of sustained maintenance despite the recent registry release.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented. This is a transparency gap for a package intended for application integration.

Version stabilitycaution

Version 0.2.0 is not a stable major release, so the API may still change. It is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

All nine action references are unpinned, and the audit found a high-confidence, high-severity bot-conditions issue in the Dependabot auto-merge workflow. There are no untrusted checkouts or script-injection findings, but the workflow controls still warrant caution.