Trust Card · Static snapshot
modelcontextprotocol__registry U

Ungraded — insufficient static coverage · 0 findings (0 critical) · scope moderate · Not ranked: insufficient static coverage.
Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream modelcontextprotocol/registry @ 11b7b0e (2026-10-11)
Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.
Insufficient static coverage: No non-empty supported source analyzed; documentation and data alone provide limited coverage; Unsupported source present; Symlinks or special files were not examined. Findings remain actionable; absence of findings is not evidence of safety.
Coverage: limited

Static-heuristic scope: 30 analyzed / 258 discovered files; 188 unsupported source files; 230 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.
No non-empty supported source analyzed; documentation and data alone provide limited coverage
Unsupported source present
Symlinks or special files were not examined
Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
Ignored directories, declarations, and non-implementation assets are outside rule scope.
File coverage, applied rules and scan limits
{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "No non-empty supported source analyzed; documentation and data alone provide limited coverage",
    "Unsupported source present",
    "Symlinks or special files were not examined"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 258,
  "analyzedFiles": [
    {
      "path": ".github/dependabot.yml",
      "scope": "data",
      "bytes": 581,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/cancel-pulumi-lock.yml",
      "scope": "data",
      "bytes": 2634,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/ci.yml",
      "scope": "data",
      "bytes": 1603,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/claude.yml",
      "scope": "data",
      "bytes": 1570,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/close-invalid-publish-prs.yml",
      "scope": "data",
      "bytes": 6639,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/deploy-production.yml",
      "scope": "data",
      "bytes": 1516,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/deploy-staging.yml",
      "scope": "data",
      "bytes": 3163,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/detect-invalid-publish-prs.yml",
      "scope": "data",
      "bytes": 3881,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/release.yml",
      "scope": "data",
      "bytes": 2591,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/sync-db.yml",
      "scope": "data",
      "bytes": 17381,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/sync-schema.yml",
      "scope": "data",
      "bytes": 2306,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".golangci.yml",
      "scope": "data",
      "bytes": 1665,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".goreleaser.yaml",
      "scope": "data",
      "bytes": 2999,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".ko.yaml",
      "scope": "data",
      "bytes": 877,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".vscode/launch.json",
      "scope": "data",
      "bytes": 892,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "data/seed.json",
      "scope": "data",
      "bytes": 5351,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "deploy/Pulumi.gcpProd.yaml",
      "scope": "data",
      "bytes": 5095,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "deploy/Pulumi.gcpStaging.yaml",
      "scope": "data",
      "bytes": 5002,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "deploy/Pulumi.local.yaml",
      "scope": "data",
      "bytes": 522,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "deploy/Pulumi.yaml",
      "scope": "data",
      "bytes": 127,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "docker-compose.yml",
      "scope": "data",
      "bytes": 2217,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "docs/reference/api/openapi.yaml",
      "scope": "data",
      "bytes": 43665,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "docs/reference/server-json/draft/server.schema.json",
      "scope": "data",
      "bytes": 22455,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "internal/validators/schemas/2025-07-09.json",
      "scope": "data",
      "bytes": 17657,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "internal/validators/schemas/2025-09-16.json",
      "scope": "data",
      "bytes": 17638,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "internal/validators/schemas/2025-09-29.json",
      "scope": "data",
      "bytes": 17122,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "internal/validators/schemas/2025-10-11.json",
      "scope": "data",
      "bytes": 20686,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "internal/validators/schemas/2025-10-17.json",
      "scope": "data",
      "bytes": 20686,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "internal/validators/schemas/2025-12-11.json",
      "scope": "data",
      "bytes": 22172,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "tests/integration/docker-compose.integration-test.yml",
      "scope": "data",
      "bytes": 449,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    ".env.example",
    ".githooks/pre-commit",
    ".ko.dockerignore",
    "Makefile",
    "cmd/publisher/auth/azurekeyvault/common.go",
    "cmd/publisher/auth/common.go",
    "cmd/publisher/auth/dns.go",
    "cmd/publisher/auth/github-at.go",
    "cmd/publisher/auth/github-oidc.go",
    "cmd/publisher/auth/github-oidc_internal_test.go",
    "cmd/publisher/auth/github_at_device_flow_internal_test.go",
    "cmd/publisher/auth/github_at_poll_internal_test.go",
    "cmd/publisher/auth/github_at_test.go",
    "cmd/publisher/auth/googlekms/common.go",
    "cmd/publisher/auth/http.go",
    "cmd/publisher/auth/interface.go",
    "cmd/publisher/auth/none.go",
    "cmd/publisher/commands/init.go",
    "cmd/publisher/commands/init_test.go",
    "cmd/publisher/commands/login.go",
    "cmd/publisher/commands/login_test.go",
    "cmd/publisher/commands/logout.go",
    "cmd/publisher/commands/logout_test.go",
    "cmd/publisher/commands/publish.go",
    "cmd/publisher/commands/publish_test.go",
    "cmd/publisher/commands/status.go",
    "cmd/publisher/commands/status_test.go",
    "cmd/publisher/commands/testutil_test.go",
    "cmd/publisher/commands/unicode.go",
    "cmd/publisher/commands/validate.go",
    "cmd/publisher/commands/validate_test.go",
    "cmd/publisher/main.go",
    "cmd/registry/main.go",
    "deploy/Makefile",
    "deploy/go.mod",
    "deploy/go.sum",
    "deploy/main.go",
    "deploy/pkg/k8s/backup.go",
    "deploy/pkg/k8s/cert_manager.go",
    "deploy/pkg/k8s/deploy.go",
    "deploy/pkg/k8s/ingress.go",
    "deploy/pkg/k8s/monitoring.go",
    "deploy/pkg/k8s/postgres.go",
    "deploy/pkg/k8s/registry.go",
    "deploy/pkg/providers/gcp/provider.go",
    "deploy/pkg/providers/local/provider.go",
    "deploy/pkg/providers/types.go",
    "docs/modelcontextprotocol-io/about.mdx",
    "docs/modelcontextprotocol-io/authentication.mdx",
    "docs/modelcontextprotocol-io/faq.mdx",
    "docs/modelcontextprotocol-io/github-actions.mdx",
    "docs/modelcontextprotocol-io/moderation-policy.mdx",
    "docs/modelcontextprotocol-io/package-types.mdx",
    "docs/modelcontextprotocol-io/quickstart.mdx",
    "docs/modelcontextprotocol-io/registry-aggregators.mdx",
    "docs/modelcontextprotocol-io/remote-servers.mdx",
    "docs/modelcontextprotocol-io/terms-of-service.mdx",
    "docs/modelcontextprotocol-io/versioning.mdx",
    "go.mod",
    "go.sum",
    "internal/api/cors_preflight_test.go",
    "internal/api/handlers/v0/auth/common.go",
    "internal/api/handlers/v0/auth/common_test.go",
    "internal/api/handlers/v0/auth/dns.go",
    "internal/api/handlers/v0/auth/dns_test.go",
    "internal/api/handlers/v0/auth/github_at.go",
    "internal/api/handlers/v0/auth/github_at_internal_test.go",
    "internal/api/handlers/v0/auth/github_at_test.go",
    "internal/api/handlers/v0/auth/github_oidc.go",
    "internal/api/handlers/v0/auth/github_oidc_test.go",
    "internal/api/handlers/v0/auth/http.go",
    "internal/api/handlers/v0/auth/http_internal_test.go",
    "internal/api/handlers/v0/auth/http_test.go",
    "internal/api/handlers/v0/auth/main.go",
    "internal/api/handlers/v0/auth/none.go",
    "internal/api/handlers/v0/auth/none_test.go",
    "internal/api/handlers/v0/auth/oidc.go",
    "internal/api/handlers/v0/auth/oidc_internal_test.go",
    "internal/api/handlers/v0/auth/oidc_test.go",
    "internal/api/handlers/v0/edit.go",
    "internal/api/handlers/v0/edit_test.go",
    "internal/api/handlers/v0/health.go",
    "internal/api/handlers/v0/health_test.go",
    "internal/api/handlers/v0/list_errors.go",
    "internal/api/handlers/v0/list_errors_test.go",
    "internal/api/handlers/v0/openapi.go",
    "internal/api/handlers/v0/ping.go",
    "internal/api/handlers/v0/ping_test.go",
    "internal/api/handlers/v0/publish.go",
    "internal/api/handlers/v0/publish_integration_test.go",
    "internal/api/handlers/v0/publish_registry_validation_test.go",
    "internal/api/handlers/v0/publish_test.go",
    "internal/api/handlers/v0/response.go",
    "internal/api/handlers/v0/servers.go",
    "internal/api/handlers/v0/servers_test.go",
    "internal/api/handlers/v0/status.go",
    "internal/api/handlers/v0/status_test.go",
    "internal/api/handlers/v0/telemetry_test.go",
    "internal/api/handlers/v0/ui.go",
    "internal/api/handlers/v0/ui_index.html",
    "internal/api/handlers/v0/ui_test.go",
    "internal/api/handlers/v0/validate.go",
    "internal/api/handlers/v0/validate_test.go",
    "internal/api/handlers/v0/version.go",
    "internal/api/handlers/v0/version_test.go",
    "internal/api/openapi_compliance_test.go",
    "internal/api/router/router.go",
    "internal/api/router/router_test.go",
    "internal/api/router/v0.go",
    "internal/api/server.go",
    "internal/api/server_test.go",
    "internal/auth/blocks.go",
    "internal/auth/jwt.go",
    "internal/auth/jwt_test.go",
    "internal/auth/types.go",
    "internal/config/config.go",
    "internal/database/database.go",
    "internal/database/migrate.go",
    "internal/database/migrations/001_initial_schema.sql",
    "internal/database/migrations/002_add_server_extensions.sql",
    "internal/database/migrations/003_simplify_to_key_value.sql",
    "internal/database/migrations/004_update_meta_field_format.sql",
    "internal/database/migrations/005_add_server_id_rename_version_id.sql",
    "internal/database/migrations/006_migrate_server_json_camelcase.sql",
    "internal/database/migrations/007_add_publish_constraints.sql",
    "internal/database/migrations/008_clean_invalid_data.sql",
    "internal/database/migrations/009_separate_official_metadata.sql",
    "internal/database/migrations/010_migrate_canonical_package_refs.sql",
    "internal/database/migrations/011_fix_empty_schema_fields.sql",
    "internal/database/migrations/012_fix_nuget_registry_base_url.sql",
    "internal/database/migrations/013_add_status_fields.sql",
    "internal/database/migrations/014_heal_is_latest.sql",
    "internal/database/postgres.go",
    "internal/database/postgres_test.go",
    "internal/database/testutil.go",
    "internal/importer/importer.go",
    "internal/importer/importer_test.go",
    "internal/service/registry_service.go",
    "internal/service/registry_service_test.go",
    "internal/service/service.go",
    "internal/service/versioning.go",
    "internal/service/versioning_test.go",
    "internal/telemetry/metrics.go",
    "internal/telemetry/metrics_test.go",
    "internal/validators/constants.go",
    "internal/validators/package.go",
    "internal/validators/registries/cargo.go",
    "internal/validators/registries/cargo_internal_test.go",
    "internal/validators/registries/cargo_test.go",
    "internal/validators/registries/export_test.go",
    "internal/validators/registries/mcpb.go",
    "internal/validators/registries/mcpb_test.go",
    "internal/validators/registries/mcpname.go",
    "internal/validators/registries/mcpname_internal_test.go",
    "internal/validators/registries/npm.go",
    "internal/validators/registries/npm_test.go",
    "internal/validators/registries/nuget.go",
    "internal/validators/registries/nuget_test.go",
    "internal/validators/registries/oci.go",
    "internal/validators/registries/oci_test.go",
    "internal/validators/registries/pypi.go",
    "internal/validators/registries/pypi_test.go",
    "internal/validators/registries/testutils_test.go",
    "internal/validators/schema.go",
    "internal/validators/schema_regex_test.go",
    "internal/validators/schema_test.go",
    "internal/validators/utils.go",
    "internal/validators/validation_detailed_test.go",
    "internal/validators/validation_types.go",
    "internal/validators/validation_types_test.go",
    "internal/validators/validators.go",
    "internal/validators/validators_test.go",
    "pkg/api/v0/types.go",
    "pkg/model/constants.go",
    "pkg/model/types.go",
    "scripts/mirror_data/fetch_production_data.go",
    "scripts/mirror_data/load_production_data.go",
    "scripts/test_endpoints.sh",
    "scripts/test_publish.sh",
    "tests/integration/main.go",
    "tests/integration/run.sh",
    "tools/admin/auth.sh",
    "tools/admin/takedown.sh",
    "tools/extract-server-schema/main.go",
    "tools/validate-examples/main.go",
    "tools/validate-examples.sh",
    "tools/validate-schemas/main.go",
    "tools/validate-schemas.sh"
  ],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": "AGENTS.md",
      "reason": "non-regular-file"
    },
    {
      "path": ".env.example",
      "reason": "unsupported-implementation"
    },
    {
      "path": ".githooks/pre-commit",
      "reason": "unsupported-implementation"
    },
    {
      "path": ".github/copilot-instructions.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".ko.dockerignore",
      "reason": "unsupported-implementation"
    },
    {
      "path": "CLAUDE.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "CONTRIBUTING.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Makefile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "SECURITY.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "cmd/publisher/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "cmd/publisher/auth/azurekeyvault/common.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/common.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/dns.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/github-at.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/github-oidc.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/github-oidc_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/github_at_device_flow_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/github_at_poll_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/github_at_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/googlekms/common.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/http.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/interface.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/auth/none.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/init.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/init_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/login.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/login_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/logout.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/logout_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/publish.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/publish_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/status.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/status_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/testutil_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/unicode.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/validate.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/commands/validate_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/publisher/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "cmd/registry/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/.gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": "deploy/Makefile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "deploy/go.mod",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/go.sum",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/backup.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/cert_manager.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/deploy.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/ingress.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/monitoring.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/postgres.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/k8s/registry.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/providers/gcp/provider.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/providers/local/provider.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "deploy/pkg/providers/types.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/administration/admin-operations.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/administration/maintainer-onboarding.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/community-projects.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/contributing/add-package-registry.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/contributing/releasing.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/design-principles.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/dev-summit-2025-05-registry-goals-presentation.pdf",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/dev-summit-2025-10-registry-status-presentation.pdf",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/ecosystem-diagram.excalidraw.svg",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/ecosystem-vision.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/proposed-enhanced-validation.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/roadmap.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/design/tech-architecture.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/modelcontextprotocol-io/about.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/authentication.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/ecosystem-diagram.excalidraw.svg",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/modelcontextprotocol-io/faq.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/github-actions.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/moderation-policy.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/package-types.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/quickstart.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/registry-aggregators.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/remote-servers.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/terms-of-service.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/modelcontextprotocol-io/versioning.mdx",
      "reason": "unsupported-implementation"
    },
    {
      "path": "docs/reference/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/api/CHANGELOG.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/api/extensions.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/api/generic-registry-api.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/api/official-registry-api.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/api/registry-authorization.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/cli/commands.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/server-json/CHANGELOG.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/server-json/CONTRIBUTING.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/server-json/generic-server-json.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/reference/server-json/official-registry-requirements.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "go.mod",
      "reason": "unsupported-implementation"
    },
    {
      "path": "go.sum",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/cors_preflight_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/common.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/common_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/dns.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/dns_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/github_at.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/github_at_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/github_at_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/github_oidc.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/github_oidc_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/http.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/http_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/http_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/none.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/none_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/oidc.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/oidc_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/auth/oidc_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/edit.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/edit_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/health.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/health_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/list_errors.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/list_errors_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/openapi.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/ping.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/ping_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/publish.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/publish_integration_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/publish_registry_validation_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/publish_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/response.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/servers.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/servers_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/status.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/status_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/telemetry_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/ui.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/ui_index.html",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/ui_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/validate.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/validate_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/version.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/handlers/v0/version_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/openapi_compliance_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/router/router.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/router/router_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/router/v0.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/server.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/api/server_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/auth/blocks.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/auth/jwt.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/auth/jwt_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/auth/types.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/config/config.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/database.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrate.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/001_initial_schema.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/002_add_server_extensions.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/003_simplify_to_key_value.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/004_update_meta_field_format.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/005_add_server_id_rename_version_id.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/006_migrate_server_json_camelcase.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/007_add_publish_constraints.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/008_clean_invalid_data.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/009_separate_official_metadata.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/010_migrate_canonical_package_refs.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/011_fix_empty_schema_fields.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/012_fix_nuget_registry_base_url.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/013_add_status_fields.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/migrations/014_heal_is_latest.sql",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/postgres.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/postgres_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/database/testutil.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/importer/importer.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/importer/importer_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/service/registry_service.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/service/registry_service_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/service/service.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/service/versioning.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/service/versioning_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/telemetry/metrics.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/telemetry/metrics_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/constants.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/package.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/cargo.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/cargo_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/cargo_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/export_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/mcpb.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/mcpb_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/mcpname.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/mcpname_internal_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/npm.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/npm_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/nuget.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/nuget_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/oci.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/oci_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/pypi.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/pypi_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/registries/testutils_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/schema.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/schema_regex_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/schema_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/schemas/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "internal/validators/utils.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/validation_detailed_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/validation_types.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/validation_types_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/validators.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "internal/validators/validators_test.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "pkg/api/v0/types.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "pkg/model/constants.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "pkg/model/types.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "scripts/mirror_data/.gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": "scripts/mirror_data/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "scripts/mirror_data/fetch_production_data.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "scripts/mirror_data/load_production_data.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "scripts/test_endpoints.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "scripts/test_publish.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tests/integration/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "tests/integration/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tests/integration/run.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/admin/auth.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/admin/takedown.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/extract-server-schema/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/validate-examples/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/validate-examples.sh",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/validate-schemas/main.go",
      "reason": "unsupported-implementation"
    },
    {
      "path": "tools/validate-schemas.sh",
      "reason": "unsupported-implementation"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}
Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.
Permissions

Scope: moderate · Shell: disabled · Network egress: no · File deletion: none · Human approval: none
Provenance

License: none detected · Lockfile: no · Security policy: yes · Signals: unverified origin
Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/modelcontextprotocol/registry. Scores move with every upstream commit; pages refresh weekly. How scoring works.