@modelcontextprotocol/server-shadertoy MIT 20 versions

@modelcontextprotocol/server-shadertoy

npm Repository Homepage

MCP App Server example for rendering ShaderToy-compatible GLSL shaders

20

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jspahrsummerspcarletonfweinbergerthedspashwin-antochafik-ant

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:zod	AI (phantom-deps): Declared runtime dependency; heuristic false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:cors	AI (phantom-deps): Declared runtime dependency; heuristic false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:express	AI (phantom-deps): Declared runtime dependency; heuristic false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:@modelcontextprotocol/ext-apps	AI (phantom-deps): Same-org scoped dependency; heuristic false positive for this package.	ai	2026/04/29
bogus-package	bogus-package	AI (bogus-package): Official @modelcontextprotocol org package with SLSA provenance; bogus signals are false positives for this example server.	ai	2026/04/29

Versions (showing 20 of 20)

Version	Deps	Published
1.7.3	5 / 8	2026-06-01
1.7.2	5 / 8	2026-05-15
1.7.1	5 / 8	2026-04-27
1.7.0	5 / 8	2026-04-21
1.6.0	5 / 8	2026-04-14
1.5.0	5 / 8	2026-04-02
1.4.0	5 / 8	2026-04-02
1.3.2	5 / 8	2026-03-27
1.3.1	5 / 8	2026-03-23
1.3.0	5 / 8	2026-03-23
1.2.2	5 / 8	2026-03-10
1.2.1	5 / 8	2026-03-10
1.2.0	5 / 8	2026-03-06
1.1.2	5 / 8	2026-02-25
1.1.1	5 / 8	2026-02-24
1.1.0	5 / 8	2026-02-22
1.0.1	5 / 8	2026-01-26
1.0.0	5 / 8	2026-01-26
0.4.2	5 / 8	2026-01-26
0.4.1	5 / 8	2026-01-15

v1.7.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.5.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher ochafik-ant; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (9 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.