The package is well documented, licensed, and backed by repository tests and a security policy. Its young history, concentrated contributions, and unpinned workflow actions leave meaningful maintenance and build-integrity caveats.
72%
Total Score
67
81
88
The repository is owned by an individual account rather than an organization, so the small active contributor base has less visible institutional backing to absorb maintainer loss.
The package is only 44 days old with three releases, so there is little long-term evidence of maintenance or release stability despite its active initial publication period.
Two contributors were active, but the leading contributor made 9 of 11 commits, leaving maintenance substantially concentrated in one person.
Composer build tooling is present, but no security-scanning tool was detected, leaving security-focused project checks less transparent.
Version 0.1.6 is not a stable major release, so its API and behavior may still change substantially even though it is not marked as a prerelease.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
mcp/sdk Version ^0.7 | — | — |
symfony/ai-mate Version ^0.12 | — | — |
symfony/console Version ^6.4 || ^7.3 || ^8.0 | — | — |
helgesverre/toon Version ^3.2.1 | — | — |
symfony/filesystem Version ^6.4 || ^7.3 || ^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.