@modelcontextprotocol/server-budget-allocator MIT 20 versions

@modelcontextprotocol/server-budget-allocator

npm Repository Homepage

Budget allocator MCP App Server with interactive visualization

20

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jspahrsummerspcarletonfweinbergerthedspashwin-antochafik-ant

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:zod	AI (phantom-deps): Runtime dependency; used in server code despite analyzer heuristic.	ai	2026/04/29
phantom-deps	phantom-dep:cors	AI (phantom-deps): Runtime dependency; used in express server setup.	ai	2026/04/29
phantom-deps	phantom-dep:express	AI (phantom-deps): Runtime dependency; core to HTTP server implementation.	ai	2026/04/29
phantom-deps	phantom-dep:chart.js	AI (phantom-deps): Runtime dependency; used in visualization component.	ai	2026/04/29
phantom-deps	phantom-dep:@modelcontextprotocol/ext-apps	AI (phantom-deps): Parent org package; legitimate dependency for MCP app.	ai	2026/04/29
bogus-package	bogus-package	AI (bogus-package): Official @modelcontextprotocol org example package with SLSA provenance; bogus-package signal is a false positive here.	ai	2026/04/29

Versions (showing 20 of 20)

Version	Deps	Published
1.7.3	6 / 8	2026-06-01
1.7.2	6 / 8	2026-05-15
1.7.1	6 / 8	2026-04-27
1.7.0	6 / 8	2026-04-21
1.6.0	6 / 8	2026-04-14
1.5.0	6 / 8	2026-04-02
1.4.0	6 / 8	2026-04-02
1.3.2	6 / 8	2026-03-27
1.3.1	6 / 8	2026-03-23
1.3.0	6 / 8	2026-03-23
1.2.2	6 / 8	2026-03-10
1.2.1	6 / 8	2026-03-10
1.2.0	6 / 8	2026-03-06
1.1.2	6 / 8	2026-02-25
1.1.1	6 / 8	2026-02-24
1.1.0	6 / 8	2026-02-22
1.0.1	6 / 8	2026-01-26
1.0.0	6 / 8	2026-01-26
0.4.2	6 / 8	2026-01-26
0.4.1	6 / 8	2026-01-15

v1.7.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.5.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (8 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes across all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (7 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.