@modelcontextprotocol/server-wiki-explorer MIT 20 versions

@modelcontextprotocol/server-wiki-explorer

npm Repository Homepage

Wikipedia link explorer MCP App Server with graph visualization

20

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jspahrsummerspcarletonfweinbergerthedspashwin-antochafik-ant

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): Official MCP package with legitimate purpose; README link dump is documentation style, not spam.	ai	2026/07/03
source-diff	encoded-string-file:dist/server.js	AI (source-diff): Encoded string is undici's llhttp WASM binary (wasmBase64); stable bundled dependency, not malicious.	ai	2026/05/17
phantom-deps	phantom-dep:cors	AI (phantom-deps): Directly imported in server code; false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:@modelcontextprotocol/ext-apps	AI (phantom-deps): Legitimate scoped org dependency; false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:express	AI (phantom-deps): Directly imported in server code; false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:cheerio	AI (phantom-deps): Directly imported in server code; false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:zod	AI (phantom-deps): Directly imported in server code; false positive for this package.	ai	2026/04/29

Versions (showing 20 of 20)

Version	Deps	Published
1.7.3	6 / 9	2026-06-01
1.7.2	6 / 9	2026-05-15
1.7.1	6 / 9	2026-04-27
1.7.0	6 / 9	2026-04-21
1.6.0	6 / 9	2026-04-14
1.5.0	6 / 9	2026-04-02
1.4.0	6 / 9	2026-04-02
1.3.2	6 / 9	2026-03-27
1.3.1	6 / 9	2026-03-23
1.3.0	6 / 9	2026-03-23
1.2.2	6 / 9	2026-03-10
1.2.1	6 / 9	2026-03-10
1.2.0	6 / 9	2026-03-06
1.1.2	6 / 9	2026-02-25
1.1.1	6 / 9	2026-02-24
1.1.0	6 / 9	2026-02-22
1.0.1	6 / 9	2026-01-26
1.0.0	6 / 9	2026-01-26
0.4.2	6 / 9	2026-01-26
0.4.1	6 / 9	2026-01-15

v1.7.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.7.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.5.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.0

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (10 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

2 findings

HIGH Low-value / spam package indicators (2 signals, score 3) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Publisher ochafik-ant is SPAM-FLAGGED; generalizes to all versions published by this account.) Matched 2 signal(s), weighted score 3: • [S_README_LINKDUMP] README is a link dump (9 URLs) that barely mentions the package — typical of phishing link farms. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.