koriym/xdebug-mcp

Project backingcaution

The repository is owned by a user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

One maintainer made all 54 commits in the last three months, concentrating maintenance knowledge and creating a meaningful continuity risk for this user-owned project.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. The missing scanning is a modest supply-chain hygiene gap, not evidence of abandonment.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and disclosure expectations unclear.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers or audit findings, but all 9 action references are unpinned. That weakens build reproducibility and introduces avoidable action-update risk.