mcp-dependency-review

Statically reviews repo-scoped MCP configuration files for mutable package references (like @latest or version ranges) and classifies their drift risk without executing any servers.

Lift—not yet benchmarked

Trustsecurity · quality · license · upkeep

Scan Saferisk 0/100

LicenseMITserved via MCP

What it does

Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. Use when reviewing .mcp.json, Cursor, VS Code, Claude, Windsurf, or other repo-scoped MCP config.

#mcp#dependency-review#supply-chain#static-analysis#ci

Quality judgment

completeness

9.0/10

clarity

9.0/10

trigger quality

8.0/10

examples

7.0/10

structure

9.0/10

overall

9.0/10

Exceptionally well-scoped static review skill with precise classification tables, explicit safety boundaries, and anti-patterns. Trigger conditions are concrete and the workflow is reproducible; only weakness is limited worked examples (one JSON case) despite many inline selector illustrations.

Files (3)

agents/openai.yaml · 0.3 KBLICENSE · 1.0 KBSKILL.md · 10.0 KB