redberry/mcp-client-laravel

Lifecycle scriptscaution

The package declares a post-autoload-dump install lifecycle script. Such scripts increase install-time behavior and deserve review, but this signal alone does not show harmful or excessive activity.

Security policycaution

The linked repository has no security policy. That weakens the project's documented vulnerability-reporting process, although dependabot scanning provides some compensating security tooling.

Version stabilitycaution

The assessed release is a prerelease, while the registry reports v1.1.1 as the latest stable version and a 25% recent prerelease share. This makes the release less suitable for a dependency requiring a stable API.

Workflow auditcaution

All five workflows were analyzed, but all 11 action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a workflow concern rather than a severe release risk.