@modelcontextprotocol/ext-apps
19
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
jspahrsummerspcarletonfweinbergerthedspashwin-antochafik-ant
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/src/server/index.js | AI (source-diff): PostMessageTransport class using window.postMessage — standard browser IPC, not exfiltration. | ai | |
| source-diff | net-exec-file:dist/src/app-with-deps.js | AI (source-diff): Bundled Zod+MCP SDK code; network/exec patterns are from postMessage transport and schema validation, not malware. | ai | |
| source-diff | net-exec-file:dist/src/react/react-with-deps.js | AI (source-diff): Same bundled MCP transport + Zod patterns as app-with-deps. Legitimate browser messaging code. | ai | |
| source-diff | obfuscated-file:dist/src/app-with-deps.js | AI (source-diff): Bundled output from esbuild containing Zod + MCP SDK; '-with-deps' exports are documented in package.json. Standard minification, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/src/react/react-with-deps.js | AI (source-diff): Bundled React+Zod+MCP SDK output for the react-with-deps export. Standard esbuild minification. | ai | |
| source-diff | obfuscated-file:dist/src/server/index.js | AI (source-diff): Bundled server module with MCP SDK protocol handling. Standard esbuild minification output. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): prettier is used as a CLI tool in npm scripts (generate:schemas, prettier:fix), not via JS import. Stable false positive. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs setup-bun.mjs to bootstrap Bun runtime used by the build system; graceful fallback with || echo. Consistent with @oven/bun-* optional deps. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 1.7.5 | 1 / 30 | |
| 1.7.4 | 1 / 30 | |
| 1.7.3 | 1 / 30 | |
| 1.7.2 | 1 / 30 | |
| 1.7.1 | 1 / 30 | |
| 1.7.0 | 1 / 30 | |
| 1.6.0 | 0 / 30 | |
| 1.5.0 | 0 / 30 | |
| 1.4.0 | 0 / 30 | |
| 1.3.2 | 0 / 30 | |
| 1.3.1 | 0 / 30 | |
| 1.1.1 | 0 / 29 | |
| 0.2.2 | 1 / 19 | |
| 0.2.1 | 1 / 19 | |
| 0.2.0 | 1 / 19 | |
| 0.1.0 | 4 / 15 | |
| 0.0.7 | 4 / 13 | |
| 0.0.6 | 4 / 13 | |
| 0.0.1 | 5 / 12 |
v1.7.5
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.