@kryptosai/mcp-observatory 1.32.0 → 1.32.1

package/docs/safety-index/targets.json

@@ -338,5 +338,540 @@
     "failureClass": "Browser/code execution boundary",
     "whyItMatters": "Coding agents may use Chrome DevTools MCP to inspect pages, network state, console output, and browser behavior before making changes.",
     "reproductionNotes": "Zero-config public package; browser-control findings should be treated as policy-review prompts, not vulnerability claims."
+  },
+  {
+    "id": "slack-server",
+    "name": "Official Slack MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-slack",
+    "category": "Communication",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-slack"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Messaging platform access",
+    "failureClass": "Message/channel boundary",
+    "whyItMatters": "Slack MCP servers can expose channel history, message posting, and workspace search capabilities to agents.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation requires a Slack token."
+  },
+  {
+    "id": "google-drive-server",
+    "name": "Official Google Drive MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-google-drive",
+    "category": "Cloud Storage",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-google-drive"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Cloud file access",
+    "failureClass": "Document/permission boundary",
+    "whyItMatters": "Google Drive agents can read, write, search, and manage permissions on cloud documents the token can reach.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation requires Google OAuth credentials."
+  },
+  {
+    "id": "mongodb-server",
+    "name": "Anthropic MongoDB MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-mongodb",
+    "packageName": "@anthropic/mcp-server-mongodb",
+    "category": "Database",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-mongodb"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Database mutation",
+    "failureClass": "Data query/collection boundary",
+    "whyItMatters": "MongoDB MCP servers can expose collection queries, document CRUD, and index management to agents.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation requires a MongoDB connection string."
+  },
+  {
+    "id": "cloudflare-server",
+    "name": "Anthropic Cloudflare MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-cloudflare",
+    "packageName": "@anthropic/mcp-server-cloudflare",
+    "category": "Infrastructure",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-cloudflare"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Infrastructure control",
+    "failureClass": "DNS/worker/deployment boundary",
+    "whyItMatters": "Cloudflare MCP servers can expose DNS records, Workers, KV stores, and deployment pipelines to agents.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation requires Cloudflare API credentials."
+  },
+  {
+    "id": "qdrant-server",
+    "name": "Anthropic Qdrant MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-qdrant",
+    "packageName": "@anthropic/mcp-server-qdrant",
+    "category": "Vector Database",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-qdrant"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Vector database mutation",
+    "failureClass": "Collection/point boundary",
+    "whyItMatters": "Qdrant MCP servers can expose vector search, collection management, and point CRUD to agents.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation requires a Qdrant cluster URL and API key."
+  },
+  {
+    "id": "vercel-ai-server",
+    "name": "Anthropic Vercel AI SDK MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-vercel-ai",
+    "packageName": "@anthropic/mcp-server-vercel-ai",
+    "category": "AI/LLM Platform",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-vercel-ai"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "AI platform access",
+    "failureClass": "Deployment/project boundary",
+    "whyItMatters": "Vercel AI SDK MCP servers can expose project management, deployment triggers, and AI model configuration to agents.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation may require Vercel API credentials."
+  },
+  {
+    "id": "tavily-search-server",
+    "name": "Anthropic Tavily Search MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-tavily",
+    "packageName": "@anthropic/mcp-server-tavily",
+    "category": "Search",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-tavily"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Untrusted content retrieval",
+    "failureClass": "Search result boundary",
+    "whyItMatters": "Tavily search MCP servers can return untrusted web search results directly into agent context.",
+    "reproductionNotes": "Schema-only evaluation; full tool invocation may require a Tavily API key."
+  },
+  {
+    "id": "stripe-server",
+    "name": "Stripe MCP",
+    "repo": "https://www.npmjs.com/package/@stripe/mcp",
+    "packageName": "@stripe/mcp",
+    "category": "Payments / SaaS",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@stripe/mcp"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Payment API boundary",
+    "failureClass": "Financial transaction tool boundary",
+    "whyItMatters": "Stripe tools can create customers, process payments, and manage subscriptions — financial mutation surfaces that need visible boundaries.",
+    "reproductionNotes": "Schema-only; requires Stripe API key for full scan. Tool listing exposes payment operations."
+  },
+  {
+    "id": "notion-server",
+    "name": "Notion MCP",
+    "repo": "https://www.npmjs.com/package/@notionhq/notion-mcp-server",
+    "packageName": "@notionhq/notion-mcp-server",
+    "category": "Productivity / Docs",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@notionhq/notion-mcp-server"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Workspace document access",
+    "failureClass": "Page/database boundary",
+    "whyItMatters": "Notion MCP servers can read, write, and search across workspace pages, databases, and comments.",
+    "reproductionNotes": "Schema-only; requires Notion API integration token for full scan."
+  },
+  {
+    "id": "linear-server",
+    "name": "Linear MCP",
+    "repo": "https://www.npmjs.com/package/mcp-server-linear",
+    "packageName": "mcp-server-linear",
+    "category": "Project Management",
+    "command": "npx",
+    "args": [
+      "-y",
+      "mcp-server-linear"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Issue tracking mutation",
+    "failureClass": "Issue/project boundary",
+    "whyItMatters": "Linear MCP servers expose issue creation, team management, and cycle tracking to agents.",
+    "reproductionNotes": "Schema-only; requires Linear API key for full scan."
+  },
+  {
+    "id": "figma-server",
+    "name": "Figma MCP",
+    "repo": "https://www.npmjs.com/package/figma-mcp-express",
+    "packageName": "figma-mcp-express",
+    "category": "Design",
+    "command": "npx",
+    "args": [
+      "-y",
+      "figma-mcp-express"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Design system access",
+    "failureClass": "Design/file boundary",
+    "whyItMatters": "Figma MCP servers can expose design files, components, and styles to agents for design-to-code workflows.",
+    "reproductionNotes": "Schema-only; requires Figma access token for full scan."
+  },
+  {
+    "id": "firecrawl-server",
+    "name": "Firecrawl MCP",
+    "repo": "https://www.npmjs.com/package/firecrawl-mcp",
+    "packageName": "firecrawl-mcp",
+    "category": "Web Data / Search",
+    "command": "npx",
+    "args": [
+      "-y",
+      "firecrawl-mcp"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Web scraping and crawling",
+    "failureClass": "Web content ingestion boundary",
+    "whyItMatters": "Firecrawl MCP servers expose web scraping, crawling, and content extraction tools that can pull untrusted content into agent context.",
+    "reproductionNotes": "May work without auth for tool listing; full crawl operations require a Firecrawl API key."
+  },
+  {
+    "id": "exa-server",
+    "name": "Exa Search MCP",
+    "repo": "https://www.npmjs.com/package/exa-mcp-server",
+    "packageName": "exa-mcp-server",
+    "category": "Search",
+    "command": "npx",
+    "args": [
+      "-y",
+      "exa-mcp-server"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Untrusted content retrieval",
+    "failureClass": "Search result boundary",
+    "whyItMatters": "Exa MCP servers return web search and crawling results into agent context from untrusted sources.",
+    "reproductionNotes": "Schema-only; full search requires an Exa API key."
+  },
+  {
+    "id": "sentry-server",
+    "name": "Sentry MCP",
+    "repo": "https://www.npmjs.com/package/@sentry/mcp-server",
+    "packageName": "@sentry/mcp-server",
+    "category": "Observability",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@sentry/mcp-server"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Error/performance data access",
+    "failureClass": "Issue/event boundary",
+    "whyItMatters": "Sentry MCP servers expose error, performance, and release data to agents, which can reveal sensitive stack traces and PII fields.",
+    "reproductionNotes": "Schema-only; requires Sentry auth token for full scan."
+  },
+  {
+    "id": "neon-server",
+    "name": "Neon MCP",
+    "repo": "https://www.npmjs.com/package/mcp-server-neon",
+    "packageName": "mcp-server-neon",
+    "category": "Database",
+    "command": "npx",
+    "args": [
+      "-y",
+      "mcp-server-neon"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Database provisioning",
+    "failureClass": "Database/branch boundary",
+    "whyItMatters": "Neon MCP servers can provision databases, manage branches, and run SQL — cloud database operations with production implications.",
+    "reproductionNotes": "Schema-only; requires Neon API key and project ID for full scan."
+  },
+  {
+    "id": "supabase-server",
+    "name": "Supabase MCP",
+    "repo": "https://www.npmjs.com/package/@supabase/mcp-server-supabase",
+    "packageName": "@supabase/mcp-server-supabase",
+    "category": "Backend / Database",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@supabase/mcp-server-supabase"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Database and auth management",
+    "failureClass": "Database/auth/admin boundary",
+    "whyItMatters": "Supabase MCP servers can manage tables, run SQL, manage auth users, and control Edge Functions — broad backend control surface.",
+    "reproductionNotes": "Schema-only; requires Supabase access token for full scan."
+  },
+  {
+    "id": "docker-server",
+    "name": "Docker MCP",
+    "repo": "https://www.npmjs.com/package/mcp-server-docker",
+    "packageName": "mcp-server-docker",
+    "category": "Containers",
+    "command": "npx",
+    "args": [
+      "-y",
+      "mcp-server-docker"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Container orchestration",
+    "failureClass": "Container/image boundary",
+    "whyItMatters": "Docker MCP servers expose container run, exec, and image management tools — container-level command execution is a high-trust boundary.",
+    "reproductionNotes": "Schema-only; requires Docker Desktop running for full scan. Tool listing may succeed without a running daemon."
+  },
+  {
+    "id": "postgres-server",
+    "name": "Official PostgreSQL MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-postgres",
+    "category": "Database",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-postgres",
+      "postgres://localhost:5432/db"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Database mutation",
+    "failureClass": "SQL query boundary",
+    "whyItMatters": "PostgreSQL MCP servers can run arbitrary SQL queries against connected databases — a high-trust data mutation surface.",
+    "reproductionNotes": "Scanned with dummy connection string for schema discovery. Full query execution requires a real PostgreSQL connection. Note: npm flags this package as deprecated by the publisher."
+  },
+  {
+    "id": "sqlite-server",
+    "name": "Official SQLite MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-sqlite",
+    "category": "Database",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-sqlite",
+      "/tmp/test.db"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Local database mutation",
+    "failureClass": "SQLite file boundary",
+    "whyItMatters": "SQLite MCP servers can grant agents read/write/query access to local database files with SQL execution capabilities.",
+    "reproductionNotes": "Package not published on npm (404). Available in the servers monorepo. Use community packages like mcp-sqlite or build from source."
+  },
+  {
+    "id": "fetch-server",
+    "name": "Official Fetch MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-fetch",
+    "category": "Web Content / Search",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-fetch"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Untrusted content retrieval",
+    "failureClass": "Web fetch boundary",
+    "whyItMatters": "Fetch MCP servers can retrieve arbitrary web content and feed it into agent context — a prompt injection and content trust boundary.",
+    "reproductionNotes": "Package not published on npm (404). Available in the servers monorepo. Use community packages like mcp-fetch-server or build from source."
+  },
+  {
+    "id": "brave-search-server",
+    "name": "Official Brave Search MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-brave-search",
+    "category": "Search",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-brave-search"
+    ],
+    "env": {
+      "BRAVE_API_KEY": "BSA-dummy-key-for-schema-scan-only"
+    },
+    "timeoutMs": 60000,
+    "riskClass": "Untrusted content retrieval",
+    "failureClass": "Search result boundary",
+    "whyItMatters": "Brave Search MCP servers return web and local search results into agent context — untrusted content ingestion vector.",
+    "reproductionNotes": "Scanned with dummy API key for schema/tool discovery. Full search execution requires a valid Brave Search API key. Note: npm flags this package as deprecated by the publisher."
+  },
+  {
+    "id": "gitlab-server",
+    "name": "Official GitLab MCP server",
+    "repo": "https://github.com/modelcontextprotocol/servers",
+    "packageName": "@modelcontextprotocol/server-gitlab",
+    "category": "Developer Tools",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@modelcontextprotocol/server-gitlab"
+    ],
+    "env": {
+      "GITLAB_PERSONAL_ACCESS_TOKEN": "glpat-dummy-token-for-schema-scan-only"
+    },
+    "timeoutMs": 60000,
+    "riskClass": "Repository mutation and CI control",
+    "failureClass": "Merge/CI pipeline boundary",
+    "whyItMatters": "GitLab MCP servers expose repository operations, merge requests, issues, and CI pipeline controls — high-stakes write access across repos.",
+    "reproductionNotes": "Scanned with dummy token for schema/tool discovery. Server responds but tools have schema validation issues preventing full listing. Note: npm flags this package as deprecated by the publisher."
+  },
+  {
+    "id": "gmail-server",
+    "name": "Anthropic Gmail MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-gmail",
+    "packageName": "@anthropic/mcp-server-gmail",
+    "category": "Email",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-gmail"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Email platform access",
+    "failureClass": "Email read/write boundary",
+    "whyItMatters": "Gmail MCP servers can read, send, archive, and manage emails on behalf of users — high-stakes message access that needs visible boundaries before agents are trusted with inbox control.",
+    "reproductionNotes": "Schema-only evaluation; requires Gmail OAuth credentials. Note: @anthropic/mcp-server-gmail has not been published to npm. Community equivalent: gmail-mcp."
+  },
+  {
+    "id": "jina-server",
+    "name": "Anthropic Jina AI MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-jina",
+    "packageName": "@anthropic/mcp-server-jina",
+    "category": "Search / AI",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-jina"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Untrusted content retrieval",
+    "failureClass": "Web search/reader boundary",
+    "whyItMatters": "Jina AI MCP servers can perform web search and content reading — untrusted content ingestion into agent context.",
+    "reproductionNotes": "Schema-only evaluation; requires Jina AI API key. Note: @anthropic/mcp-server-jina has not been published to npm. Community equivalent: jina-mcp-tools."
+  },
+  {
+    "id": "google-sheets-server",
+    "name": "Anthropic Google Sheets MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-google-sheets",
+    "packageName": "@anthropic/mcp-server-google-sheets",
+    "category": "Productivity / Spreadsheets",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-google-sheets"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Spreadsheet data access",
+    "failureClass": "Spreadsheet read/write boundary",
+    "whyItMatters": "Google Sheets MCP servers can read, write, and query spreadsheet data — agents with sheet access can modify business-critical data.",
+    "reproductionNotes": "Schema-only evaluation; requires Google Sheets OAuth credentials. Note: @anthropic/mcp-server-google-sheets has not been published to npm. Community equivalent: google-sheets-mcp."
+  },
+  {
+    "id": "google-calendar-server",
+    "name": "Anthropic Google Calendar MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-google-calendar",
+    "packageName": "@anthropic/mcp-server-google-calendar",
+    "category": "Productivity / Calendar",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-google-calendar"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Calendar data access",
+    "failureClass": "Calendar event boundary",
+    "whyItMatters": "Google Calendar MCP servers can create, read, update, and delete calendar events — agents can schedule meetings and modify availability.",
+    "reproductionNotes": "Schema-only evaluation; requires Google Calendar OAuth credentials. Note: @anthropic/mcp-server-google-calendar has not been published to npm. Community equivalent: @cocal/google-calendar-mcp."
+  },
+  {
+    "id": "google-tasks-server",
+    "name": "Anthropic Google Tasks MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-google-tasks",
+    "packageName": "@anthropic/mcp-server-google-tasks",
+    "category": "Productivity / Tasks",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-google-tasks"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Task management access",
+    "failureClass": "Task list mutation boundary",
+    "whyItMatters": "Google Tasks MCP servers can create, list, update, and delete user tasks — agents can manage personal task lists with real user data.",
+    "reproductionNotes": "Schema-only evaluation; requires Google Tasks OAuth credentials. Note: @anthropic/mcp-server-google-tasks has not been published to npm. Community equivalent: @overlay-one/google-tasks-mcp-server."
+  },
+  {
+    "id": "huggingface-server",
+    "name": "Anthropic HuggingFace MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-huggingface",
+    "packageName": "@anthropic/mcp-server-huggingface",
+    "category": "AI / ML Platform",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-huggingface"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "ML model and dataset access",
+    "failureClass": "Model/inference boundary",
+    "whyItMatters": "HuggingFace MCP servers can access models, datasets, and inference endpoints — agents could download or interact with ML artifacts.",
+    "reproductionNotes": "Schema-only evaluation; requires HuggingFace API token. Note: @anthropic/mcp-server-huggingface has not been published to npm. Community equivalent: huggingface-mcp-server."
+  },
+  {
+    "id": "reddit-server",
+    "name": "Anthropic Reddit MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-reddit",
+    "packageName": "@anthropic/mcp-server-reddit",
+    "category": "Social Media",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-reddit"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Social platform access",
+    "failureClass": "Content posting/reading boundary",
+    "whyItMatters": "Reddit MCP servers can browse posts, search content, and interact with subreddits — agents could post or retrieve content from social platforms.",
+    "reproductionNotes": "Schema-only evaluation; requires Reddit API credentials. Note: @anthropic/mcp-server-reddit has not been published to npm. Community equivalent: reddit-mcp."
+  },
+  {
+    "id": "onesignal-server",
+    "name": "Anthropic OneSignal MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-onesignal",
+    "packageName": "@anthropic/mcp-server-onesignal",
+    "category": "Notifications / Messaging",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-onesignal"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "Push notification platform access",
+    "failureClass": "Notification/audience boundary",
+    "whyItMatters": "OneSignal MCP servers can send push notifications, manage segments, and configure messaging campaigns — agent-triggered notifications to real users is a high-stakes boundary.",
+    "reproductionNotes": "Schema-only evaluation; requires OneSignal API credentials. Note: @anthropic/mcp-server-onesignal has not been published to npm. No community MCP equivalent found as of this writing."
+  },
+  {
+    "id": "clay-server",
+    "name": "Anthropic Clay MCP server",
+    "repo": "https://www.npmjs.com/package/@anthropic/mcp-server-clay",
+    "packageName": "@anthropic/mcp-server-clay",
+    "category": "CRM / Contact Management",
+    "command": "npx",
+    "args": [
+      "-y",
+      "@anthropic/mcp-server-clay"
+    ],
+    "timeoutMs": 60000,
+    "riskClass": "CRM data access",
+    "failureClass": "Contact/relationship boundary",
+    "whyItMatters": "Clay MCP servers can access contact data, enrichment, and relationship intelligence — agents could read or modify CRM records with personal and business contact data.",
+    "reproductionNotes": "Schema-only evaluation; requires Clay API credentials. Note: @anthropic/mcp-server-clay has not been published to npm. Community equivalent: @clayhq/clay-mcp."
   }
 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryptosai/mcp-observatory",
-  "version": "1.32.0",
+  "version": "1.32.1",
   "description": "GitHub-native CI, SARIF, Code Scanning, and security gates for MCP servers before agents depend on them.",
   "mcpName": "io.github.KryptosAI/mcp-observatory",
   "license": "MIT",