elliottlawson/mcp-php-sdk
It has one maintainer, no security policy or scanning, and all three workflow actions are unpinned. Tests, release notes, a clear MIT declaration, and an unarchived repository provide useful reassurance.
58%
Total Score
50
79
50
Health Score Breakdown
Only one registry account, Elliott Lawson, has publishing access. The matching user-owned repository provides clear ownership, but the project has limited maintainer redundancy.
The package has only 3 releases, all published within about 1 day in March 2025, with no releases in the last 12 months. That suggests maintenance may have stopped, although the release history is not extensive enough to establish abandonment alone.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the last push being about 18 months ago. This is a meaningful maintenance and abandonment concern.
Composer is used for builds, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence that the package is unsafe.
The repository has no security policy. That reduces transparency about vulnerability reporting and maintenance response expectations.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Elliott Lawson |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^3.0 | — | — |
ramsey/uuid Version ^4.2 | — | — |
react/promise Version ^2.9 | — | — |
psr/http-message Version ^1.0 | — | — |
psr/event-dispatcher Version ^1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.