tourze/mcp-contracts
The package has clear documentation, tests, an MIT license, and a matching repository. Its small release history and unpinned workflow actions reduce confidence, while the absent security policy is a minor transparency gap.
78%
Total Score
100
100
88
83
Health Score Breakdown
Only two releases exist over roughly 15 months, with one release in the last 12 months and about 128 days between releases; this indicates limited demonstrated maintenance capacity.
Composer build tooling is present, but no security scanning tool was detected; for a small library this is a minor hygiene gap rather than a severe maintenance risk.
The repository has no security policy, leaving vulnerability-reporting expectations unspecified. This is a transparency gap, but it is partly offset by the small project scope and tests.
Both workflows were analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all three action references are unpinned, which weakens build reproducibility and supply-chain hygiene.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/dependency-injection Version ^7.3 | — | — |
Weekly Downloads
Info
- Last Published
- 10 months ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.