rewi.sh/craft-mcp

Release historycaution

This is the package's first release, published today, so there is no prior release or cadence evidence to demonstrate sustained maintenance.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tooling is present, leaving a modest transparency and maintenance gap for a package with remote HTTP and token features.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less clear for a plugin that exposes HTTP access and bearer tokens.

Workflow auditcaution

Both workflows were analyzed cleanly with no untrusted checkouts, injection findings, or high-severity issues. However, all four action references are unpinned and the release workflow grants top-level write permissions, creating a mild supply-chain hygiene concern.