PulseAugur
EN
LIVE 11:29:54

Top AI agent packages show supply-chain risks, including official reference implementation

By PulseAugur Editorial · [1 sources] ·

A recent analysis of the top 50 Model Context Protocol (MCP) npm packages revealed significant supply-chain risks, particularly in packages with high download counts. The study, which combined behavioral signals with static analysis for CWE-22 vulnerabilities, found that the two most downloaded packages, chrome-devtools-mcp and @upstash/context7-mcp, both scored 'WARN'. The official reference implementation, @modelcontextprotocol/server-filesystem, also received a 'WARN' score due to numerous pattern flags, highlighting the need for manual audits. AI

IMPACT Highlights critical supply-chain vulnerabilities in packages used by AI agents, potentially impacting agent security and reliability.

RANK_REASON This is a research paper detailing a novel analysis of supply-chain risks in MCP npm packages. [lever_c_demoted from research: ic=1 ai=1.0]

Read on dev.to — MCP tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Top AI agent packages show supply-chain risks, including official reference implementation

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
This is a research paper detailing a novel analysis of supply-chain risks in MCP npm packages. [lever_c_demoted from research: ic=1 ai=1.0]
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
safety, paper
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
144 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — MCP tag TIER_1 English(EN) · Pico ·

    We Scored the Top 50 MCP npm Packages on Supply-Chain Risk. Here's What We Found.

    <p>We ranked the 50 most-downloaded MCP server packages on npm by weekly install count. For each, we combined behavioral signals (maintainer count, package age, publish cadence) with CWE-22 static analysis from our <a href="https://dev.to/blog/mcp-path-traversal-pattern">mcp-scan…

RELATED ENTITIES

RELATED TOPICS