MCP server

io.github.Nekzus/npm-sentinel-mcp

mcp:nekzus/npm-sentinel-mcp

Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.

Docker MCP Catalog Glama MCP Registry Smithery

Verdict

No issues found

No suspicious or malicious behavior was found.

Analyzed Oct 26, 2026, 12:05 UTC at 98964a1

findings

—

highest severity

threat classes

files scanned

1,621/1,621

checks satisfied

package advisories

Why this verdict

benign: 1621 checks satisfied, no findings for mcp-server:.

Security findings 0

No security findings

No suspicious or malicious behavior was found; 2 candidate findings were refuted on review.

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

The pnpm workspace config allows install-time build scripts for packages such as keytar (a native credential-store binding), sharp and workerd. An npm-metadata lookup server does not plainly need these, and the allowance is undeclared.

pnpm-workspace.yaml:4

keytar: true

Why it was refuted

The allowBuilds list is a pnpm allowlist for build scripts of ordinary dev/build dependencies (esbuild, sharp, workerd, @smithery/cli, keytar), which is a normal config for a TypeScript MCP server deployed via Smithery. It carries no instruction to the agent and no source-to-sink chain, and the file shows no malicious behavior. It is a broad-permission-style setting, not a harm.

Supply chain

mediumRefutedlow confidence

The workspace config exempts the @modelcontextprotocol client, core and server 2.0.0 packages from the minimum-release-age protection. Freshly published packages therefore install without the usual quarantine delay.

pnpm-workspace.yaml:7-10

'@modelcontextprotocol/server@2.0.0'

Why it was refuted

The exclusion covers only three pinned 2.0.0 versions of the official @modelcontextprotocol packages, which are the core dependencies of an MCP server. Exempting pinned official-registry packages from the release-age delay is a common, benign practice. No chain or concealed behavior is shown.