mcp-dependency-review
Statically reviews repo-scoped MCP configuration files for mutable package references (like @latest or version ranges) and classifies their drift risk without executing any servers.
Lift—not yet benchmarked
92
Trustsecurity · quality · license · upkeep
Scan Saferisk 0/100
LicenseMITserved via MCP
Saferisk 0/100scanner: sb-static v1 (SkillSpector integration is a seam)
No findings on this version.
Methodology: static pass over the pinned file tree — secret patterns, binaries, install hooks, URL allowlist comparison, allowed-tools breadth. Full methodology →