@modelcontextprotocol/server-basic-vanillajs
Basic MCP App Server example using vanilla JavaScript
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Zod is imported in TypeScript sources; heuristic misses transpiled imports. | ai | |
| phantom-deps | phantom-dep:cors | AI (phantom-deps): cors is imported in TypeScript sources; heuristic misses transpiled imports. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): express is imported in TypeScript sources; heuristic misses transpiled imports. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/ext-apps | AI (phantom-deps): Same-org scoped dep; legitimate internal reference in example package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Example/reference package in monorepo; link dump and missing keywords are expected. | ai |
Versions (showing 20 of 20)
| Version | Deps | Published |
|---|---|---|
| 1.7.5 | 5 / 8 | |
| 1.7.3 | 5 / 8 | |
| 1.7.2 | 5 / 8 | |
| 1.7.1 | 5 / 8 | |
| 1.7.0 | 5 / 8 | |
| 1.6.0 | 5 / 8 | |
| 1.5.0 | 5 / 8 | |
| 1.4.0 | 5 / 8 | |
| 1.3.2 | 5 / 8 | |
| 1.3.1 | 5 / 8 | |
| 1.3.0 | 5 / 8 | |
| 1.2.2 | 5 / 8 | |
| 1.2.1 | 5 / 8 | |
| 1.2.0 | 5 / 8 | |
| 1.1.2 | 5 / 8 | |
| 1.1.1 | 5 / 8 | |
| 1.1.0 | 5 / 8 | |
| 1.0.1 | 5 / 8 | |
| 1.0.0 | 5 / 8 | |
| 0.4.2 | 5 / 8 |
v1.7.5
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (ochafik-ant) than the most recent previously approved version (ochafik) on 2026-07-23, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.7.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.6.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.5.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.4.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.0.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.0.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (11 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.