@kryptosai/mcp-observatory 1.32.0 → 1.33.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (408) hide show
  1. package/README.md +9 -13
  2. package/README.zh-CN.md +4 -10
  3. package/dist/src/adapters/base.d.ts +14 -0
  4. package/dist/src/adapters/base.js +2 -0
  5. package/dist/src/adapters/base.js.map +1 -0
  6. package/dist/src/checks/semantics.d.ts +2 -0
  7. package/dist/src/checks/semantics.js +48 -0
  8. package/dist/src/checks/semantics.js.map +1 -0
  9. package/dist/src/cli.js +8 -2
  10. package/dist/src/cli.js.map +1 -1
  11. package/dist/src/commands/audit.js +7 -1
  12. package/dist/src/commands/audit.js.map +1 -1
  13. package/dist/src/commands/enforce.d.ts +2 -2
  14. package/dist/src/commands/enforce.js +19 -11
  15. package/dist/src/commands/enforce.js.map +1 -1
  16. package/dist/src/commands/helpers.d.ts +2 -0
  17. package/dist/src/commands/helpers.js +8 -1
  18. package/dist/src/commands/helpers.js.map +1 -1
  19. package/dist/src/commands/scan.d.ts +14 -0
  20. package/dist/src/commands/scan.js +42 -3
  21. package/dist/src/commands/scan.js.map +1 -1
  22. package/dist/src/commands/score.js +22 -1
  23. package/dist/src/commands/score.js.map +1 -1
  24. package/dist/src/commands/skill-scan.js +5 -3
  25. package/dist/src/commands/skill-scan.js.map +1 -1
  26. package/dist/src/commands/test.d.ts +19 -0
  27. package/dist/src/commands/test.js +70 -4
  28. package/dist/src/commands/test.js.map +1 -1
  29. package/dist/src/commercial.js +2 -2
  30. package/dist/src/commercial.js.map +1 -1
  31. package/dist/src/diff/diff.d.ts +2 -0
  32. package/dist/src/diff/diff.js +81 -0
  33. package/dist/src/diff/diff.js.map +1 -0
  34. package/dist/src/reporters/json.d.ts +2 -0
  35. package/dist/src/reporters/json.js +4 -0
  36. package/dist/src/reporters/json.js.map +1 -0
  37. package/dist/src/runner/runner.d.ts +2 -0
  38. package/dist/src/runner/runner.js +135 -0
  39. package/dist/src/runner/runner.js.map +1 -0
  40. package/dist/src/storage/filesystem.d.ts +6 -0
  41. package/dist/src/storage/filesystem.js +21 -0
  42. package/dist/src/storage/filesystem.js.map +1 -0
  43. package/dist/src/telemetry.d.ts +25 -3
  44. package/dist/src/telemetry.js +84 -18
  45. package/dist/src/telemetry.js.map +1 -1
  46. package/dist/src/validate.js +5 -6
  47. package/dist/src/validate.js.map +1 -1
  48. package/docs/mcp-server-safety-index.md +317 -8
  49. package/docs/safety-index/artifacts/1link-mcp.json +66 -0
  50. package/docs/safety-index/artifacts/1link-mcp.md +106 -0
  51. package/docs/safety-index/artifacts/aadhaar-mcp.json +66 -0
  52. package/docs/safety-index/artifacts/aadhaar-mcp.md +106 -0
  53. package/docs/safety-index/artifacts/aikidosec-mcp-server.json +536 -0
  54. package/docs/safety-index/artifacts/aikidosec-mcp-server.md +203 -0
  55. package/docs/safety-index/artifacts/aiou-mcp.json +66 -0
  56. package/docs/safety-index/artifacts/aiou-mcp.md +106 -0
  57. package/docs/safety-index/artifacts/airtable-mcp-server.json +66 -0
  58. package/docs/safety-index/artifacts/airtable-mcp-server.md +106 -0
  59. package/docs/safety-index/artifacts/alpaca-server.json +66 -0
  60. package/docs/safety-index/artifacts/alpaca-server.md +106 -0
  61. package/docs/safety-index/artifacts/antv-chart-server.json +1454 -21
  62. package/docs/safety-index/artifacts/antv-chart-server.md +155 -9
  63. package/docs/safety-index/artifacts/apify-mcp-server.json +66 -0
  64. package/docs/safety-index/artifacts/apify-mcp-server.md +103 -0
  65. package/docs/safety-index/artifacts/apple-music-server.json +66 -0
  66. package/docs/safety-index/artifacts/apple-music-server.md +102 -0
  67. package/docs/safety-index/artifacts/appwrite-mcp.json +66 -0
  68. package/docs/safety-index/artifacts/appwrite-mcp.md +106 -0
  69. package/docs/safety-index/artifacts/aqi-india-mcp.json +66 -0
  70. package/docs/safety-index/artifacts/aqi-india-mcp.md +106 -0
  71. package/docs/safety-index/artifacts/argocd-mcp-server.json +66 -0
  72. package/docs/safety-index/artifacts/argocd-mcp-server.md +106 -0
  73. package/docs/safety-index/artifacts/arxiv-mcp-server.json +66 -0
  74. package/docs/safety-index/artifacts/arxiv-mcp-server.md +100 -0
  75. package/docs/safety-index/artifacts/aws-mcp-server.json +66 -0
  76. package/docs/safety-index/artifacts/aws-mcp-server.md +103 -0
  77. package/docs/safety-index/artifacts/azure-devops-mcp-server.json +66 -0
  78. package/docs/safety-index/artifacts/azure-devops-mcp-server.md +106 -0
  79. package/docs/safety-index/artifacts/azure-mcp-server.json +66 -0
  80. package/docs/safety-index/artifacts/azure-mcp-server.md +102 -0
  81. package/docs/safety-index/artifacts/bhuvan-mcp.json +66 -0
  82. package/docs/safety-index/artifacts/bhuvan-mcp.md +106 -0
  83. package/docs/safety-index/artifacts/brave-search-mcp-server-v2.json +66 -0
  84. package/docs/safety-index/artifacts/brave-search-mcp-server-v2.md +103 -0
  85. package/docs/safety-index/artifacts/brave-search-server.json +341 -0
  86. package/docs/safety-index/artifacts/brave-search-server.md +201 -0
  87. package/docs/safety-index/artifacts/browsermcp-server.json +83 -18
  88. package/docs/safety-index/artifacts/browsermcp-server.md +46 -12
  89. package/docs/safety-index/artifacts/cal-com-mcp.json +66 -0
  90. package/docs/safety-index/artifacts/cal-com-mcp.md +106 -0
  91. package/docs/safety-index/artifacts/canvas-server.json +66 -0
  92. package/docs/safety-index/artifacts/canvas-server.md +105 -0
  93. package/docs/safety-index/artifacts/caselaw-server.json +66 -0
  94. package/docs/safety-index/artifacts/caselaw-server.md +106 -0
  95. package/docs/safety-index/artifacts/chatwoot-mcp.json +66 -0
  96. package/docs/safety-index/artifacts/chatwoot-mcp.md +102 -0
  97. package/docs/safety-index/artifacts/chrome-devtools-mcp-server.json +596 -25
  98. package/docs/safety-index/artifacts/chrome-devtools-mcp-server.md +97 -15
  99. package/docs/safety-index/artifacts/circleci-server.json +1606 -0
  100. package/docs/safety-index/artifacts/circleci-server.md +243 -0
  101. package/docs/safety-index/artifacts/clarity-server.json +794 -0
  102. package/docs/safety-index/artifacts/clarity-server.md +201 -0
  103. package/docs/safety-index/artifacts/clay-server.json +66 -0
  104. package/docs/safety-index/artifacts/clay-server.md +106 -0
  105. package/docs/safety-index/artifacts/clickup-mcp-server.json +66 -0
  106. package/docs/safety-index/artifacts/clickup-mcp-server.md +106 -0
  107. package/docs/safety-index/artifacts/cloudflare-mcp-server-v2.json +66 -0
  108. package/docs/safety-index/artifacts/cloudflare-mcp-server-v2.md +102 -0
  109. package/docs/safety-index/artifacts/cloudflare-server.json +66 -0
  110. package/docs/safety-index/artifacts/cloudflare-server.md +106 -0
  111. package/docs/safety-index/artifacts/coinbase-cds-server.json +322 -0
  112. package/docs/safety-index/artifacts/coinbase-cds-server.md +201 -0
  113. package/docs/safety-index/artifacts/confluence-mcp-server.json +1727 -0
  114. package/docs/safety-index/artifacts/confluence-mcp-server.md +255 -0
  115. package/docs/safety-index/artifacts/context7-server.json +85 -18
  116. package/docs/safety-index/artifacts/context7-server.md +52 -11
  117. package/docs/safety-index/artifacts/contract-analysis-server.json +66 -0
  118. package/docs/safety-index/artifacts/contract-analysis-server.md +106 -0
  119. package/docs/safety-index/artifacts/cowin-mcp.json +66 -0
  120. package/docs/safety-index/artifacts/cowin-mcp.md +106 -0
  121. package/docs/safety-index/artifacts/currents-mcp-server.json +66 -0
  122. package/docs/safety-index/artifacts/currents-mcp-server.md +102 -0
  123. package/docs/safety-index/artifacts/cyanheads-git-mcp-server.json +1565 -34
  124. package/docs/safety-index/artifacts/cyanheads-git-mcp-server.md +178 -17
  125. package/docs/safety-index/artifacts/dalle-server.json +66 -0
  126. package/docs/safety-index/artifacts/dalle-server.md +104 -0
  127. package/docs/safety-index/artifacts/daraz-mcp.json +66 -0
  128. package/docs/safety-index/artifacts/daraz-mcp.md +106 -0
  129. package/docs/safety-index/artifacts/desktop-commander-mcp-server.json +2348 -0
  130. package/docs/safety-index/artifacts/desktop-commander-mcp-server.md +266 -0
  131. package/docs/safety-index/artifacts/digilocker-mcp.json +66 -0
  132. package/docs/safety-index/artifacts/digilocker-mcp.md +106 -0
  133. package/docs/safety-index/artifacts/discord-mcp-server.json +1297 -0
  134. package/docs/safety-index/artifacts/discord-mcp-server.md +169 -0
  135. package/docs/safety-index/artifacts/discord-mcp.json +1023 -0
  136. package/docs/safety-index/artifacts/discord-mcp.md +229 -0
  137. package/docs/safety-index/artifacts/docker-server.json +395 -0
  138. package/docs/safety-index/artifacts/docker-server.md +204 -0
  139. package/docs/safety-index/artifacts/dynamodb-mcp-server.json +66 -0
  140. package/docs/safety-index/artifacts/dynamodb-mcp-server.md +103 -0
  141. package/docs/safety-index/artifacts/dynatrace-mcp-server.json +66 -0
  142. package/docs/safety-index/artifacts/dynatrace-mcp-server.md +103 -0
  143. package/docs/safety-index/artifacts/easypaisa-mcp.json +553 -0
  144. package/docs/safety-index/artifacts/easypaisa-mcp.md +205 -0
  145. package/docs/safety-index/artifacts/ehsaas-mcp.json +66 -0
  146. package/docs/safety-index/artifacts/ehsaas-mcp.md +106 -0
  147. package/docs/safety-index/artifacts/epic-server.json +66 -0
  148. package/docs/safety-index/artifacts/epic-server.md +106 -0
  149. package/docs/safety-index/artifacts/eslint-mcp-server.json +320 -0
  150. package/docs/safety-index/artifacts/eslint-mcp-server.md +201 -0
  151. package/docs/safety-index/artifacts/espn-server.json +394 -0
  152. package/docs/safety-index/artifacts/espn-server.md +187 -0
  153. package/docs/safety-index/artifacts/everything-server.json +145 -18
  154. package/docs/safety-index/artifacts/everything-server.md +56 -11
  155. package/docs/safety-index/artifacts/exa-server.json +400 -0
  156. package/docs/safety-index/artifacts/exa-server.md +207 -0
  157. package/docs/safety-index/artifacts/executeautomation-playwright-server.json +625 -18
  158. package/docs/safety-index/artifacts/executeautomation-playwright-server.md +95 -11
  159. package/docs/safety-index/artifacts/fbr-mcp.json +66 -0
  160. package/docs/safety-index/artifacts/fbr-mcp.md +106 -0
  161. package/docs/safety-index/artifacts/fetch-server.json +66 -0
  162. package/docs/safety-index/artifacts/fetch-server.md +106 -0
  163. package/docs/safety-index/artifacts/fhir-server.json +66 -0
  164. package/docs/safety-index/artifacts/fhir-server.md +100 -0
  165. package/docs/safety-index/artifacts/figma-server.json +1766 -0
  166. package/docs/safety-index/artifacts/figma-server.md +256 -0
  167. package/docs/safety-index/artifacts/filesystem-mcp-server.json +427 -23
  168. package/docs/safety-index/artifacts/filesystem-mcp-server.md +75 -14
  169. package/docs/safety-index/artifacts/filesystem-server.json +426 -22
  170. package/docs/safety-index/artifacts/filesystem-server.md +73 -12
  171. package/docs/safety-index/artifacts/firecrawl-server.json +4056 -0
  172. package/docs/safety-index/artifacts/firecrawl-server.md +243 -0
  173. package/docs/safety-index/artifacts/flight-server.json +66 -0
  174. package/docs/safety-index/artifacts/flight-server.md +106 -0
  175. package/docs/safety-index/artifacts/foodpanda-pakistan-mcp.json +66 -0
  176. package/docs/safety-index/artifacts/foodpanda-pakistan-mcp.md +106 -0
  177. package/docs/safety-index/artifacts/gcp-mcp-server.json +66 -0
  178. package/docs/safety-index/artifacts/gcp-mcp-server.md +103 -0
  179. package/docs/safety-index/artifacts/github-mcp-server.json +374 -21
  180. package/docs/safety-index/artifacts/github-mcp-server.md +71 -15
  181. package/docs/safety-index/artifacts/gitlab-server.json +229 -0
  182. package/docs/safety-index/artifacts/gitlab-server.md +753 -0
  183. package/docs/safety-index/artifacts/gmail-server.json +66 -0
  184. package/docs/safety-index/artifacts/gmail-server.md +106 -0
  185. package/docs/safety-index/artifacts/google-calendar-server.json +66 -0
  186. package/docs/safety-index/artifacts/google-calendar-server.md +106 -0
  187. package/docs/safety-index/artifacts/google-drive-server.json +66 -0
  188. package/docs/safety-index/artifacts/google-drive-server.md +106 -0
  189. package/docs/safety-index/artifacts/google-sheets-server.json +66 -0
  190. package/docs/safety-index/artifacts/google-sheets-server.md +106 -0
  191. package/docs/safety-index/artifacts/google-tasks-server.json +66 -0
  192. package/docs/safety-index/artifacts/google-tasks-server.md +106 -0
  193. package/docs/safety-index/artifacts/gst-mcp.json +66 -0
  194. package/docs/safety-index/artifacts/gst-mcp.md +106 -0
  195. package/docs/safety-index/artifacts/gupshup-mcp.json +66 -0
  196. package/docs/safety-index/artifacts/gupshup-mcp.md +106 -0
  197. package/docs/safety-index/artifacts/hasura-mcp.json +66 -0
  198. package/docs/safety-index/artifacts/hasura-mcp.md +106 -0
  199. package/docs/safety-index/artifacts/healthcare-ayushman-bharat-mcp.json +66 -0
  200. package/docs/safety-index/artifacts/healthcare-ayushman-bharat-mcp.md +106 -0
  201. package/docs/safety-index/artifacts/hec-pakistan-mcp.json +66 -0
  202. package/docs/safety-index/artifacts/hec-pakistan-mcp.md +106 -0
  203. package/docs/safety-index/artifacts/heroku-server.json +1502 -0
  204. package/docs/safety-index/artifacts/heroku-server.md +236 -0
  205. package/docs/safety-index/artifacts/homekit-server.json +66 -0
  206. package/docs/safety-index/artifacts/homekit-server.md +106 -0
  207. package/docs/safety-index/artifacts/hotel-booking-server.json +66 -0
  208. package/docs/safety-index/artifacts/hotel-booking-server.md +106 -0
  209. package/docs/safety-index/artifacts/hubspot-mcp-server.json +66 -0
  210. package/docs/safety-index/artifacts/hubspot-mcp-server.md +106 -0
  211. package/docs/safety-index/artifacts/huggingface-server.json +66 -0
  212. package/docs/safety-index/artifacts/huggingface-server.md +106 -0
  213. package/docs/safety-index/artifacts/indian-food-nutrition-mcp.json +663 -0
  214. package/docs/safety-index/artifacts/indian-food-nutrition-mcp.md +211 -0
  215. package/docs/safety-index/artifacts/irctc-mcp.json +66 -0
  216. package/docs/safety-index/artifacts/irctc-mcp.md +106 -0
  217. package/docs/safety-index/artifacts/jazz-mcp.json +66 -0
  218. package/docs/safety-index/artifacts/jazz-mcp.md +106 -0
  219. package/docs/safety-index/artifacts/jazzcash-mcp.json +66 -0
  220. package/docs/safety-index/artifacts/jazzcash-mcp.md +102 -0
  221. package/docs/safety-index/artifacts/jina-server.json +66 -0
  222. package/docs/safety-index/artifacts/jina-server.md +106 -0
  223. package/docs/safety-index/artifacts/jira-mcp-server.json +66 -0
  224. package/docs/safety-index/artifacts/jira-mcp-server.md +104 -0
  225. package/docs/safety-index/artifacts/k2-mcp.json +66 -0
  226. package/docs/safety-index/artifacts/k2-mcp.md +106 -0
  227. package/docs/safety-index/artifacts/karachi-stock-exchange-mcp.json +67 -0
  228. package/docs/safety-index/artifacts/karachi-stock-exchange-mcp.md +114 -0
  229. package/docs/safety-index/artifacts/khan-academy-server.json +66 -0
  230. package/docs/safety-index/artifacts/khan-academy-server.md +106 -0
  231. package/docs/safety-index/artifacts/kubernetes-server.json +1126 -29
  232. package/docs/safety-index/artifacts/kubernetes-server.md +141 -18
  233. package/docs/safety-index/artifacts/langfuse-mcp.json +66 -0
  234. package/docs/safety-index/artifacts/langfuse-mcp.md +106 -0
  235. package/docs/safety-index/artifacts/linear-server.json +1494 -0
  236. package/docs/safety-index/artifacts/linear-server.md +237 -0
  237. package/docs/safety-index/artifacts/mapmyindia-mcp.json +66 -0
  238. package/docs/safety-index/artifacts/mapmyindia-mcp.md +106 -0
  239. package/docs/safety-index/artifacts/memory-server.json +191 -18
  240. package/docs/safety-index/artifacts/memory-server.md +52 -10
  241. package/docs/safety-index/artifacts/minecraft-server.json +592 -0
  242. package/docs/safety-index/artifacts/minecraft-server.md +186 -0
  243. package/docs/safety-index/artifacts/mls-server.json +66 -0
  244. package/docs/safety-index/artifacts/mls-server.md +106 -0
  245. package/docs/safety-index/artifacts/mongodb-server.json +66 -0
  246. package/docs/safety-index/artifacts/mongodb-server.md +106 -0
  247. package/docs/safety-index/artifacts/mui-mcp-server.json +419 -0
  248. package/docs/safety-index/artifacts/mui-mcp-server.md +208 -0
  249. package/docs/safety-index/artifacts/mysql-mcp-server.json +66 -0
  250. package/docs/safety-index/artifacts/mysql-mcp-server.md +106 -0
  251. package/docs/safety-index/artifacts/nadra-mcp.json +66 -0
  252. package/docs/safety-index/artifacts/nadra-mcp.md +106 -0
  253. package/docs/safety-index/artifacts/neon-server.json +66 -0
  254. package/docs/safety-index/artifacts/neon-server.md +103 -0
  255. package/docs/safety-index/artifacts/notion-server.json +7151 -0
  256. package/docs/safety-index/artifacts/notion-server.md +236 -0
  257. package/docs/safety-index/artifacts/obsidian-mcp.json +66 -0
  258. package/docs/safety-index/artifacts/obsidian-mcp.md +106 -0
  259. package/docs/safety-index/artifacts/ola-maps-mcp.json +66 -0
  260. package/docs/safety-index/artifacts/ola-maps-mcp.md +106 -0
  261. package/docs/safety-index/artifacts/olx-pakistan-mcp.json +66 -0
  262. package/docs/safety-index/artifacts/olx-pakistan-mcp.md +106 -0
  263. package/docs/safety-index/artifacts/onesignal-server.json +66 -0
  264. package/docs/safety-index/artifacts/onesignal-server.md +106 -0
  265. package/docs/safety-index/artifacts/openai-mcp-server.json +66 -0
  266. package/docs/safety-index/artifacts/openai-mcp-server.md +106 -0
  267. package/docs/safety-index/artifacts/opentofu-server.json +30 -18
  268. package/docs/safety-index/artifacts/opentofu-server.md +27 -9
  269. package/docs/safety-index/artifacts/openweather-server.json +66 -0
  270. package/docs/safety-index/artifacts/openweather-server.md +106 -0
  271. package/docs/safety-index/artifacts/pakistan-cricket-mcp.json +66 -0
  272. package/docs/safety-index/artifacts/pakistan-cricket-mcp.md +106 -0
  273. package/docs/safety-index/artifacts/pakistan-post-mcp.json +66 -0
  274. package/docs/safety-index/artifacts/pakistan-post-mcp.md +106 -0
  275. package/docs/safety-index/artifacts/pakistan-weather-mcp.json +66 -0
  276. package/docs/safety-index/artifacts/pakistan-weather-mcp.md +106 -0
  277. package/docs/safety-index/artifacts/pakwheels-mcp.json +66 -0
  278. package/docs/safety-index/artifacts/pakwheels-mcp.md +106 -0
  279. package/docs/safety-index/artifacts/paytm-mcp.json +66 -0
  280. package/docs/safety-index/artifacts/paytm-mcp.md +106 -0
  281. package/docs/safety-index/artifacts/perplexity-mcp.json +66 -0
  282. package/docs/safety-index/artifacts/perplexity-mcp.md +106 -0
  283. package/docs/safety-index/artifacts/pims-mcp.json +66 -0
  284. package/docs/safety-index/artifacts/pims-mcp.md +106 -0
  285. package/docs/safety-index/artifacts/playwright-mcp-server.json +415 -24
  286. package/docs/safety-index/artifacts/playwright-mcp-server.md +84 -20
  287. package/docs/safety-index/artifacts/postgres-server.json +330 -0
  288. package/docs/safety-index/artifacts/postgres-server.md +208 -0
  289. package/docs/safety-index/artifacts/postman-india-region.json +66 -0
  290. package/docs/safety-index/artifacts/postman-india-region.md +102 -0
  291. package/docs/safety-index/artifacts/postman-mcp-server.json +66 -0
  292. package/docs/safety-index/artifacts/postman-mcp-server.md +102 -0
  293. package/docs/safety-index/artifacts/promptopia-server.json +95 -18
  294. package/docs/safety-index/artifacts/promptopia-server.md +44 -10
  295. package/docs/safety-index/artifacts/pubmed-mcp-server.json +58 -0
  296. package/docs/safety-index/artifacts/pubmed-mcp-server.md +96 -0
  297. package/docs/safety-index/artifacts/punjab-health-mcp.json +66 -0
  298. package/docs/safety-index/artifacts/punjab-health-mcp.md +106 -0
  299. package/docs/safety-index/artifacts/puppeteer-server.json +118 -29
  300. package/docs/safety-index/artifacts/puppeteer-server.md +62 -20
  301. package/docs/safety-index/artifacts/qase-server.json +7055 -0
  302. package/docs/safety-index/artifacts/qase-server.md +329 -0
  303. package/docs/safety-index/artifacts/qdrant-server.json +66 -0
  304. package/docs/safety-index/artifacts/qdrant-server.md +106 -0
  305. package/docs/safety-index/artifacts/raspberrypi-server.json +66 -0
  306. package/docs/safety-index/artifacts/raspberrypi-server.md +106 -0
  307. package/docs/safety-index/artifacts/razorpay-mcp.json +66 -0
  308. package/docs/safety-index/artifacts/razorpay-mcp.md +103 -0
  309. package/docs/safety-index/artifacts/reddit-server.json +66 -0
  310. package/docs/safety-index/artifacts/reddit-server.md +106 -0
  311. package/docs/safety-index/artifacts/redis-server.json +66 -0
  312. package/docs/safety-index/artifacts/redis-server.md +106 -0
  313. package/docs/safety-index/artifacts/ref-tools-server.json +95 -18
  314. package/docs/safety-index/artifacts/ref-tools-server.md +43 -10
  315. package/docs/safety-index/artifacts/resend-mcp.json +66 -0
  316. package/docs/safety-index/artifacts/resend-mcp.md +102 -0
  317. package/docs/safety-index/artifacts/rozgar-mcp.json +66 -0
  318. package/docs/safety-index/artifacts/rozgar-mcp.md +106 -0
  319. package/docs/safety-index/artifacts/s3-mcp-server.json +467 -0
  320. package/docs/safety-index/artifacts/s3-mcp-server.md +209 -0
  321. package/docs/safety-index/artifacts/salesforce-mcp-server.json +66 -0
  322. package/docs/safety-index/artifacts/salesforce-mcp-server.md +106 -0
  323. package/docs/safety-index/artifacts/sehat-sahulat-mcp.json +66 -0
  324. package/docs/safety-index/artifacts/sehat-sahulat-mcp.md +106 -0
  325. package/docs/safety-index/artifacts/sendgrid-mcp.json +66 -0
  326. package/docs/safety-index/artifacts/sendgrid-mcp.md +106 -0
  327. package/docs/safety-index/artifacts/sentry-server.json +66 -0
  328. package/docs/safety-index/artifacts/sentry-server.md +106 -0
  329. package/docs/safety-index/artifacts/sequential-thinking-server.json +59 -18
  330. package/docs/safety-index/artifacts/sequential-thinking-server.md +40 -8
  331. package/docs/safety-index/artifacts/shopify-mcp-server.json +66 -0
  332. package/docs/safety-index/artifacts/shopify-mcp-server.md +106 -0
  333. package/docs/safety-index/artifacts/shopify-mcp.json +66 -0
  334. package/docs/safety-index/artifacts/shopify-mcp.md +106 -0
  335. package/docs/safety-index/artifacts/shortcut-mcp-server.json +66 -0
  336. package/docs/safety-index/artifacts/shortcut-mcp-server.md +102 -0
  337. package/docs/safety-index/artifacts/slack-server.json +66 -0
  338. package/docs/safety-index/artifacts/slack-server.md +102 -0
  339. package/docs/safety-index/artifacts/smartbear-mcp-server.json +21483 -0
  340. package/docs/safety-index/artifacts/smartbear-mcp-server.md +900 -0
  341. package/docs/safety-index/artifacts/spotify-mcp.json +2071 -0
  342. package/docs/safety-index/artifacts/spotify-mcp.md +237 -0
  343. package/docs/safety-index/artifacts/spotify-server.json +66 -0
  344. package/docs/safety-index/artifacts/spotify-server.md +106 -0
  345. package/docs/safety-index/artifacts/sqlite-server.json +67 -0
  346. package/docs/safety-index/artifacts/sqlite-server.md +106 -0
  347. package/docs/safety-index/artifacts/stable-diffusion-server.json +66 -0
  348. package/docs/safety-index/artifacts/stable-diffusion-server.md +106 -0
  349. package/docs/safety-index/artifacts/stock-nse-india.json +66 -0
  350. package/docs/safety-index/artifacts/stock-nse-india.md +106 -0
  351. package/docs/safety-index/artifacts/storybook-mcp-server.json +66 -0
  352. package/docs/safety-index/artifacts/storybook-mcp-server.md +103 -0
  353. package/docs/safety-index/artifacts/stripe-server.json +66 -0
  354. package/docs/safety-index/artifacts/stripe-server.md +106 -0
  355. package/docs/safety-index/artifacts/supabase-server.json +66 -0
  356. package/docs/safety-index/artifacts/supabase-server.md +102 -0
  357. package/docs/safety-index/artifacts/tavily-search-server.json +66 -0
  358. package/docs/safety-index/artifacts/tavily-search-server.md +106 -0
  359. package/docs/safety-index/artifacts/telegram-mcp-server.json +66 -0
  360. package/docs/safety-index/artifacts/telegram-mcp-server.md +103 -0
  361. package/docs/safety-index/artifacts/telenor-pakistan-mcp.json +66 -0
  362. package/docs/safety-index/artifacts/telenor-pakistan-mcp.md +106 -0
  363. package/docs/safety-index/artifacts/textlocal-mcp.json +66 -0
  364. package/docs/safety-index/artifacts/textlocal-mcp.md +106 -0
  365. package/docs/safety-index/artifacts/tooljet-mcp.json +66 -0
  366. package/docs/safety-index/artifacts/tooljet-mcp.md +106 -0
  367. package/docs/safety-index/artifacts/transcend-server.json +3438 -0
  368. package/docs/safety-index/artifacts/transcend-server.md +277 -0
  369. package/docs/safety-index/artifacts/trello-mcp-server.json +916 -0
  370. package/docs/safety-index/artifacts/trello-mcp-server.md +211 -0
  371. package/docs/safety-index/artifacts/twilio-mcp.json +66 -0
  372. package/docs/safety-index/artifacts/twilio-mcp.md +106 -0
  373. package/docs/safety-index/artifacts/udyam-mcp.json +66 -0
  374. package/docs/safety-index/artifacts/udyam-mcp.md +106 -0
  375. package/docs/safety-index/artifacts/ufone-mcp.json +66 -0
  376. package/docs/safety-index/artifacts/ufone-mcp.md +106 -0
  377. package/docs/safety-index/artifacts/ui5-mcp-server.json +24 -24
  378. package/docs/safety-index/artifacts/ui5-mcp-server.md +13 -13
  379. package/docs/safety-index/artifacts/unity-server.json +66 -0
  380. package/docs/safety-index/artifacts/unity-server.md +102 -0
  381. package/docs/safety-index/artifacts/upi-mcp.json +452 -0
  382. package/docs/safety-index/artifacts/upi-mcp.md +201 -0
  383. package/docs/safety-index/artifacts/vercel-ai-server.json +66 -0
  384. package/docs/safety-index/artifacts/vercel-ai-server.md +106 -0
  385. package/docs/safety-index/artifacts/vimeo-server.json +66 -0
  386. package/docs/safety-index/artifacts/vimeo-server.md +106 -0
  387. package/docs/safety-index/artifacts/weather-server.json +66 -0
  388. package/docs/safety-index/artifacts/weather-server.md +106 -0
  389. package/docs/safety-index/artifacts/whatsapp-business-mcp.json +66 -0
  390. package/docs/safety-index/artifacts/whatsapp-business-mcp.md +106 -0
  391. package/docs/safety-index/artifacts/whatsapp-mcp-server.json +66 -0
  392. package/docs/safety-index/artifacts/whatsapp-mcp-server.md +106 -0
  393. package/docs/safety-index/artifacts/whatsapp-mcp.json +66 -0
  394. package/docs/safety-index/artifacts/whatsapp-mcp.md +106 -0
  395. package/docs/safety-index/artifacts/yahoo-finance-server.json +626 -0
  396. package/docs/safety-index/artifacts/yahoo-finance-server.md +187 -0
  397. package/docs/safety-index/artifacts/youtube-mcp-server.json +58 -0
  398. package/docs/safety-index/artifacts/youtube-mcp-server.md +96 -0
  399. package/docs/safety-index/artifacts/youtube-server.json +66 -0
  400. package/docs/safety-index/artifacts/youtube-server.md +103 -0
  401. package/docs/safety-index/artifacts/zendesk-mcp.json +66 -0
  402. package/docs/safety-index/artifacts/zendesk-mcp.md +106 -0
  403. package/docs/safety-index/artifacts/zillow-server.json +66 -0
  404. package/docs/safety-index/artifacts/zillow-server.md +102 -0
  405. package/docs/safety-index/artifacts/zong-mcp.json +66 -0
  406. package/docs/safety-index/artifacts/zong-mcp.md +106 -0
  407. package/docs/safety-index/targets.json +2663 -3
  408. package/package.json +10 -9
package/docs/mcp-server-safety-index.md CHANGED
@@ -10,12 +10,12 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
10
10
 
11
11
  ## Snapshot
12
12
 
13
- - Evaluated servers: 19
14
- - Ready for CI: 8
15
- - Needs review before production: 6
16
- - Unsafe default posture: 5
17
- - Not reproducible: 0
18
- - Latest run: 2026-07-09T15:15:05.224Z
13
+ - Evaluated servers: 176
14
+ - Ready for CI: 24
15
+ - Needs review before production: 11
16
+ - Unsafe default posture: 14
17
+ - Not reproducible: 127
18
+ - Latest run: 2026-07-15T22:36:02.877Z
19
19
 
20
20
  ## Evaluations
21
21
 
@@ -28,37 +28,346 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
28
28
  | 5 | [Filesystem MCP server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | `gate` | Temporary directory filesystem access | `npx -y @modelcontextprotocol/server-filesystem <safe-empty-temp-dir>` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-filesystem \"<safe-empty-temp-dir>\"" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/filesystem-mcp-server.json) / [report](./safety-index/artifacts/filesystem-mcp-server.md) | Safety Index generation creates an empty temporary directory for the server root and sanitizes that path from public artifacts. |
29
29
  | 6 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Needs review before production** | `gate` | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
30
30
  | 7 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | `allow` | Prompt/resource contract | `npx -y promptopia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
31
- | 8 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `allow` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
31
+ | 8 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `gate` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
32
32
  | 9 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | `gate` | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
33
33
  | 10 | [Official GitHub MCP server](https://github.com/modelcontextprotocol/servers) | Developer Tools | **Needs review before production** | `gate` | Write/merge tool boundary | `npx -y @modelcontextprotocol/server-github` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-github" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/github-mcp-server.json) / [report](./safety-index/artifacts/github-mcp-server.md) | Zero-config package; tool listing succeeds without a real GitHub token, so this check is safe to run in CI. Note: npm currently flags this package as deprecated/no longer supported by the publisher — treat this target as compatibility evidence, not an endorsement of the package's maintenance status. |
34
34
  | 11 | [UI5 MCP Server](https://github.com/UI5/mcp-server) | Developer Tools | **Ready for CI** | `allow` | Framework tooling boundary | `npx -y @ui5/mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @ui5/mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ui5-mcp-server.json) / [report](./safety-index/artifacts/ui5-mcp-server.md) | Zero-config public package; tool listing works without private credentials or a project fixture. |
35
35
  | 12 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Needs review before production** | `gate` | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
36
36
  | 13 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
37
- | 14 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `allow` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
37
+ | 14 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `gate` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
38
38
  | 15 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y @playwright/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
39
39
  | 16 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | `allow` | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
40
40
  | 17 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | `quarantine` | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
41
41
  | 18 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Unsafe default posture** | `quarantine` | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
42
42
  | 19 | [Chrome DevTools MCP](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Browser Automation | **Unsafe default posture** | `gate` | Browser/code execution boundary | `npx -y chrome-devtools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y chrome-devtools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/chrome-devtools-mcp-server.json) / [report](./safety-index/artifacts/chrome-devtools-mcp-server.md) | Zero-config public package; browser-control findings should be treated as policy-review prompts, not vulnerability claims. |
43
+ | 20 | [Official Slack MCP server](https://github.com/modelcontextprotocol/servers) | Communication | **Not reproducible** | `rerun` | Message/channel boundary | `npx -y @modelcontextprotocol/server-slack` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-slack" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/slack-server.json) / [report](./safety-index/artifacts/slack-server.md) | Schema-only evaluation; full tool invocation requires a Slack token. |
44
+ | 21 | [Official Google Drive MCP server](https://github.com/modelcontextprotocol/servers) | Cloud Storage | **Not reproducible** | `rerun` | Document/permission boundary | `npx -y @modelcontextprotocol/server-google-drive` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-google-drive" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/google-drive-server.json) / [report](./safety-index/artifacts/google-drive-server.md) | Schema-only evaluation; full tool invocation requires Google OAuth credentials. |
45
+ | 22 | [Anthropic MongoDB MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-mongodb) | Database | **Not reproducible** | `rerun` | Data query/collection boundary | `npx -y @anthropic/mcp-server-mongodb` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-mongodb" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/mongodb-server.json) / [report](./safety-index/artifacts/mongodb-server.md) | Schema-only evaluation; full tool invocation requires a MongoDB connection string. |
46
+ | 23 | [Anthropic Cloudflare MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-cloudflare) | Infrastructure | **Not reproducible** | `rerun` | DNS/worker/deployment boundary | `npx -y @anthropic/mcp-server-cloudflare` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-cloudflare" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cloudflare-server.json) / [report](./safety-index/artifacts/cloudflare-server.md) | Schema-only evaluation; full tool invocation requires Cloudflare API credentials. |
47
+ | 24 | [Anthropic Qdrant MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-qdrant) | Vector Database | **Not reproducible** | `rerun` | Collection/point boundary | `npx -y @anthropic/mcp-server-qdrant` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-qdrant" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/qdrant-server.json) / [report](./safety-index/artifacts/qdrant-server.md) | Schema-only evaluation; full tool invocation requires a Qdrant cluster URL and API key. |
48
+ | 25 | [Anthropic Vercel AI SDK MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-vercel-ai) | AI/LLM Platform | **Not reproducible** | `rerun` | Deployment/project boundary | `npx -y @anthropic/mcp-server-vercel-ai` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-vercel-ai" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/vercel-ai-server.json) / [report](./safety-index/artifacts/vercel-ai-server.md) | Schema-only evaluation; full tool invocation may require Vercel API credentials. |
49
+ | 26 | [Anthropic Tavily Search MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-tavily) | Search | **Not reproducible** | `rerun` | Search result boundary | `npx -y @anthropic/mcp-server-tavily` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-tavily" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/tavily-search-server.json) / [report](./safety-index/artifacts/tavily-search-server.md) | Schema-only evaluation; full tool invocation may require a Tavily API key. |
50
+ | 27 | [Stripe MCP](https://www.npmjs.com/package/@stripe/mcp) | Payments / SaaS | **Not reproducible** | `rerun` | Financial transaction tool boundary | `npx -y @stripe/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @stripe/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/stripe-server.json) / [report](./safety-index/artifacts/stripe-server.md) | Schema-only; requires Stripe API key for full scan. Tool listing exposes payment operations. |
51
+ | 28 | [Notion MCP](https://www.npmjs.com/package/@notionhq/notion-mcp-server) | Productivity / Docs | **Needs review before production** | `gate` | Page/database boundary | `npx -y @notionhq/notion-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @notionhq/notion-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/notion-server.json) / [report](./safety-index/artifacts/notion-server.md) | Schema-only; requires Notion API integration token for full scan. |
52
+ | 29 | [Linear MCP](https://www.npmjs.com/package/mcp-server-linear) | Project Management | **Unsafe default posture** | `gate` | Issue/project boundary | `npx -y mcp-server-linear` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-linear" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/linear-server.json) / [report](./safety-index/artifacts/linear-server.md) | Schema-only; requires Linear API key for full scan. |
53
+ | 30 | [Figma MCP](https://www.npmjs.com/package/figma-mcp-express) | Design | **Needs review before production** | `gate` | Design/file boundary | `npx -y figma-mcp-express` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y figma-mcp-express" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/figma-server.json) / [report](./safety-index/artifacts/figma-server.md) | Schema-only; requires Figma access token for full scan. |
54
+ | 31 | [Firecrawl MCP](https://www.npmjs.com/package/firecrawl-mcp) | Web Data / Search | **Unsafe default posture** | `quarantine` | Web content ingestion boundary | `npx -y firecrawl-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y firecrawl-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/firecrawl-server.json) / [report](./safety-index/artifacts/firecrawl-server.md) | May work without auth for tool listing; full crawl operations require a Firecrawl API key. |
55
+ | 32 | [Exa Search MCP](https://www.npmjs.com/package/exa-mcp-server) | Search | **Needs review before production** | `gate` | Search result boundary | `npx -y exa-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y exa-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/exa-server.json) / [report](./safety-index/artifacts/exa-server.md) | Schema-only; full search requires an Exa API key. |
56
+ | 33 | [Sentry MCP](https://www.npmjs.com/package/@sentry/mcp-server) | Observability | **Not reproducible** | `rerun` | Issue/event boundary | `npx -y @sentry/mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @sentry/mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sentry-server.json) / [report](./safety-index/artifacts/sentry-server.md) | Schema-only; requires Sentry auth token for full scan. |
57
+ | 34 | [Neon MCP](https://www.npmjs.com/package/mcp-server-neon) | Database | **Not reproducible** | `rerun` | Database/branch boundary | `npx -y mcp-server-neon` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-neon" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/neon-server.json) / [report](./safety-index/artifacts/neon-server.md) | Schema-only; requires Neon API key and project ID for full scan. |
58
+ | 35 | [Supabase MCP](https://www.npmjs.com/package/@supabase/mcp-server-supabase) | Backend / Database | **Not reproducible** | `rerun` | Database/auth/admin boundary | `npx -y @supabase/mcp-server-supabase` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @supabase/mcp-server-supabase" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/supabase-server.json) / [report](./safety-index/artifacts/supabase-server.md) | Schema-only; requires Supabase access token for full scan. |
59
+ | 36 | [Docker MCP](https://www.npmjs.com/package/mcp-server-docker) | Containers | **Unsafe default posture** | `quarantine` | Container/image boundary | `npx -y mcp-server-docker` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-docker" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/docker-server.json) / [report](./safety-index/artifacts/docker-server.md) | Schema-only; requires Docker Desktop running for full scan. Tool listing may succeed without a running daemon. |
60
+ | 37 | [Official PostgreSQL MCP server](https://github.com/modelcontextprotocol/servers) | Database | **Needs review before production** | `gate` | SQL query boundary | `npx -y @modelcontextprotocol/server-postgres postgres://localhost:5432/db` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-postgres postgres://localhost:5432/db" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/postgres-server.json) / [report](./safety-index/artifacts/postgres-server.md) | Scanned with dummy connection string for schema discovery. Full query execution requires a real PostgreSQL connection. Note: npm flags this package as deprecated by the publisher. |
61
+ | 38 | [Official SQLite MCP server](https://github.com/modelcontextprotocol/servers) | Database | **Not reproducible** | `rerun` | SQLite file boundary | `npx -y @modelcontextprotocol/server-sqlite /tmp/test.db` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-sqlite /tmp/test.db" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sqlite-server.json) / [report](./safety-index/artifacts/sqlite-server.md) | Package not published on npm (404). Available in the servers monorepo. Use community packages like mcp-sqlite or build from source. |
62
+ | 39 | [Official Fetch MCP server](https://github.com/modelcontextprotocol/servers) | Web Content / Search | **Not reproducible** | `rerun` | Web fetch boundary | `npx -y @modelcontextprotocol/server-fetch` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-fetch" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/fetch-server.json) / [report](./safety-index/artifacts/fetch-server.md) | Package not published on npm (404). Available in the servers monorepo. Use community packages like mcp-fetch-server or build from source. |
63
+ | 40 | [Official Brave Search MCP server](https://github.com/modelcontextprotocol/servers) | Search | **Ready for CI** | `allow` | Search result boundary | `npx -y @modelcontextprotocol/server-brave-search` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-brave-search" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/brave-search-server.json) / [report](./safety-index/artifacts/brave-search-server.md) | Scanned with dummy API key for schema/tool discovery. Full search execution requires a valid Brave Search API key. Note: npm flags this package as deprecated by the publisher. |
64
+ | 41 | [Official GitLab MCP server](https://github.com/modelcontextprotocol/servers) | Developer Tools | **Not reproducible** | `gate` | Merge/CI pipeline boundary | `npx -y @modelcontextprotocol/server-gitlab` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-gitlab" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/gitlab-server.json) / [report](./safety-index/artifacts/gitlab-server.md) | Scanned with dummy token for schema/tool discovery. Server responds but tools have schema validation issues preventing full listing. Note: npm flags this package as deprecated by the publisher. |
65
+ | 42 | [Anthropic Gmail MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-gmail) | Email | **Not reproducible** | `rerun` | Email read/write boundary | `npx -y @anthropic/mcp-server-gmail` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-gmail" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/gmail-server.json) / [report](./safety-index/artifacts/gmail-server.md) | Schema-only evaluation; requires Gmail OAuth credentials. Note: @anthropic/mcp-server-gmail has not been published to npm. Community equivalent: gmail-mcp. |
66
+ | 43 | [Anthropic Jina AI MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-jina) | Search / AI | **Not reproducible** | `rerun` | Web search/reader boundary | `npx -y @anthropic/mcp-server-jina` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-jina" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/jina-server.json) / [report](./safety-index/artifacts/jina-server.md) | Schema-only evaluation; requires Jina AI API key. Note: @anthropic/mcp-server-jina has not been published to npm. Community equivalent: jina-mcp-tools. |
67
+ | 44 | [Anthropic Google Sheets MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-google-sheets) | Productivity / Spreadsheets | **Not reproducible** | `rerun` | Spreadsheet read/write boundary | `npx -y @anthropic/mcp-server-google-sheets` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-google-sheets" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/google-sheets-server.json) / [report](./safety-index/artifacts/google-sheets-server.md) | Schema-only evaluation; requires Google Sheets OAuth credentials. Note: @anthropic/mcp-server-google-sheets has not been published to npm. Community equivalent: google-sheets-mcp. |
68
+ | 45 | [Anthropic Google Calendar MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-google-calendar) | Productivity / Calendar | **Not reproducible** | `rerun` | Calendar event boundary | `npx -y @anthropic/mcp-server-google-calendar` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-google-calendar" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/google-calendar-server.json) / [report](./safety-index/artifacts/google-calendar-server.md) | Schema-only evaluation; requires Google Calendar OAuth credentials. Note: @anthropic/mcp-server-google-calendar has not been published to npm. Community equivalent: @cocal/google-calendar-mcp. |
69
+ | 46 | [Anthropic Google Tasks MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-google-tasks) | Productivity / Tasks | **Not reproducible** | `rerun` | Task list mutation boundary | `npx -y @anthropic/mcp-server-google-tasks` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-google-tasks" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/google-tasks-server.json) / [report](./safety-index/artifacts/google-tasks-server.md) | Schema-only evaluation; requires Google Tasks OAuth credentials. Note: @anthropic/mcp-server-google-tasks has not been published to npm. Community equivalent: @overlay-one/google-tasks-mcp-server. |
70
+ | 47 | [Anthropic HuggingFace MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-huggingface) | AI / ML Platform | **Not reproducible** | `rerun` | Model/inference boundary | `npx -y @anthropic/mcp-server-huggingface` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-huggingface" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/huggingface-server.json) / [report](./safety-index/artifacts/huggingface-server.md) | Schema-only evaluation; requires HuggingFace API token. Note: @anthropic/mcp-server-huggingface has not been published to npm. Community equivalent: huggingface-mcp-server. |
71
+ | 48 | [Anthropic Reddit MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-reddit) | Social Media | **Not reproducible** | `rerun` | Content posting/reading boundary | `npx -y @anthropic/mcp-server-reddit` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-reddit" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/reddit-server.json) / [report](./safety-index/artifacts/reddit-server.md) | Schema-only evaluation; requires Reddit API credentials. Note: @anthropic/mcp-server-reddit has not been published to npm. Community equivalent: reddit-mcp. |
72
+ | 49 | [Anthropic OneSignal MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-onesignal) | Notifications / Messaging | **Not reproducible** | `rerun` | Notification/audience boundary | `npx -y @anthropic/mcp-server-onesignal` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-onesignal" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/onesignal-server.json) / [report](./safety-index/artifacts/onesignal-server.md) | Schema-only evaluation; requires OneSignal API credentials. Note: @anthropic/mcp-server-onesignal has not been published to npm. No community MCP equivalent found as of this writing. |
73
+ | 50 | [Anthropic Clay MCP server](https://www.npmjs.com/package/@anthropic/mcp-server-clay) | CRM / Contact Management | **Not reproducible** | `rerun` | Contact/relationship boundary | `npx -y @anthropic/mcp-server-clay` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @anthropic/mcp-server-clay" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/clay-server.json) / [report](./safety-index/artifacts/clay-server.md) | Schema-only evaluation; requires Clay API credentials. Note: @anthropic/mcp-server-clay has not been published to npm. Community equivalent: @clayhq/clay-mcp. |
74
+ | 51 | [DALL-E MCP server](https://www.npmjs.com/package/dalle-mcp-server) | Media / Image Generation | **Not reproducible** | `rerun` | Image generation boundary | `npx -y dalle-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y dalle-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/dalle-server.json) / [report](./safety-index/artifacts/dalle-server.md) | Schema-only evaluation; requires OpenAI API key for full image generation scan. Community package; verify npm availability. |
75
+ | 52 | [Stable Diffusion MCP server](https://www.npmjs.com/package/stable-diffusion-mcp-server) | Media / Image Generation | **Not reproducible** | `rerun` | Model inference boundary | `npx -y stable-diffusion-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y stable-diffusion-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/stable-diffusion-server.json) / [report](./safety-index/artifacts/stable-diffusion-server.md) | Schema-only evaluation; requires Stability AI API key or local model for full scan. Community package; verify npm availability. |
76
+ | 53 | [Yahoo Finance MCP server](https://www.npmjs.com/package/yahoo-finance-mcp) | Finance / Trading | **Ready for CI** | `allow` | Market data boundary | `npx -y yahoo-finance-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y yahoo-finance-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/yahoo-finance-server.json) / [report](./safety-index/artifacts/yahoo-finance-server.md) | Schema-only evaluation; full market data queries may require API key or rate limits. Community package; verify npm availability. |
77
+ | 54 | [Alpaca Trading MCP server](https://www.npmjs.com/package/@alpacahq/alpaca-mcp-server) | Finance / Trading | **Not reproducible** | `rerun` | Trade execution boundary | `npx -y @alpacahq/alpaca-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @alpacahq/alpaca-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/alpaca-server.json) / [report](./safety-index/artifacts/alpaca-server.md) | Schema-only evaluation; requires Alpaca API key and secret for full scan. Community package; verify npm availability. |
78
+ | 55 | [Raspberry Pi MCP server](https://www.npmjs.com/package/raspberrypi-mcp-server) | IoT / Hardware | **Not reproducible** | `rerun` | GPIO/hardware boundary | `npx -y raspberrypi-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y raspberrypi-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/raspberrypi-server.json) / [report](./safety-index/artifacts/raspberrypi-server.md) | Schema-only evaluation; requires Raspberry Pi hardware or simulator for full scan. Community package; verify npm availability. |
79
+ | 56 | [HomeKit MCP server](https://www.npmjs.com/package/homekit-mcp-server) | IoT / Hardware | **Not reproducible** | `rerun` | Home automation boundary | `npx -y homekit-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y homekit-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/homekit-server.json) / [report](./safety-index/artifacts/homekit-server.md) | Schema-only evaluation; requires HomeKit bridge or simulator for full scan. Community package; verify npm availability. |
80
+ | 57 | [Minecraft MCP server](https://www.npmjs.com/package/minecraft-mcp-server) | Gaming | **Ready for CI** | `allow` | Game state boundary | `npx -y minecraft-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y minecraft-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/minecraft-server.json) / [report](./safety-index/artifacts/minecraft-server.md) | Schema-only evaluation; requires Minecraft server connection for full scan. Community package; verify npm availability. |
81
+ | 58 | [Unity MCP server](https://www.npmjs.com/package/unity-mcp-server) | Gaming | **Not reproducible** | `rerun` | Game engine boundary | `npx -y unity-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y unity-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/unity-server.json) / [report](./safety-index/artifacts/unity-server.md) | Schema-only evaluation; requires Unity Editor connection for full scan. Community package; verify npm availability. |
82
+ | 59 | [FHIR MCP server](https://www.npmjs.com/package/fhir-mcp-server) | Healthcare | **Not reproducible** | `rerun` | Patient data boundary | `npx -y fhir-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y fhir-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/fhir-server.json) / [report](./safety-index/artifacts/fhir-server.md) | Schema-only evaluation; requires FHIR endpoint and authentication for full scan. Community package; verify npm availability. |
83
+ | 60 | [Epic EHR MCP server](https://www.npmjs.com/package/epic-mcp-server) | Healthcare | **Not reproducible** | `rerun` | EHR record boundary | `npx -y epic-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y epic-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/epic-server.json) / [report](./safety-index/artifacts/epic-server.md) | Schema-only evaluation; requires Epic FHIR endpoint and OAuth credentials for full scan. Community package; verify npm availability. |
84
+ | 61 | [Case Law Search MCP server](https://www.npmjs.com/package/caselaw-mcp-server) | Legal | **Not reproducible** | `rerun` | Legal content retrieval boundary | `npx -y caselaw-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y caselaw-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/caselaw-server.json) / [report](./safety-index/artifacts/caselaw-server.md) | Schema-only evaluation; requires legal database API key for full search scan. Community package; verify npm availability. |
85
+ | 62 | [Contract Analysis MCP server](https://www.npmjs.com/package/contract-analysis-mcp) | Legal | **Not reproducible** | `rerun` | Document analysis boundary | `npx -y contract-analysis-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y contract-analysis-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/contract-analysis-server.json) / [report](./safety-index/artifacts/contract-analysis-server.md) | Schema-only evaluation; requires API key or document upload for full scan. Community package; verify npm availability. |
86
+ | 63 | [Canvas LMS MCP server](https://www.npmjs.com/package/canvas-mcp-server) | Education | **Not reproducible** | `rerun` | Course/grade boundary | `npx -y canvas-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y canvas-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/canvas-server.json) / [report](./safety-index/artifacts/canvas-server.md) | Schema-only evaluation; requires Canvas instance URL and API token for full scan. Community package; verify npm availability. |
87
+ | 64 | [Khan Academy MCP server](https://www.npmjs.com/package/khan-academy-mcp) | Education | **Not reproducible** | `rerun` | Learning content boundary | `npx -y khan-academy-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y khan-academy-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/khan-academy-server.json) / [report](./safety-index/artifacts/khan-academy-server.md) | Schema-only evaluation; requires Khan Academy API credentials for full scan. Community package; verify npm availability. |
88
+ | 65 | [Zillow MCP server](https://www.npmjs.com/package/zillow-mcp-server) | Real Estate | **Not reproducible** | `rerun` | Property listing boundary | `npx -y zillow-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y zillow-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/zillow-server.json) / [report](./safety-index/artifacts/zillow-server.md) | Schema-only evaluation; requires Zillow API key or web scraping for full scan. Community package; verify npm availability. |
89
+ | 66 | [MLS Real Estate MCP server](https://www.npmjs.com/package/mls-mcp-server) | Real Estate | **Not reproducible** | `rerun` | MLS data boundary | `npx -y mls-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mls-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/mls-server.json) / [report](./safety-index/artifacts/mls-server.md) | Schema-only evaluation; requires MLS credentials and board authorization for full scan. Community package; verify npm availability. |
90
+ | 67 | [Flight API MCP server](https://www.npmjs.com/package/flight-mcp-server) | Travel | **Not reproducible** | `rerun` | Flight search boundary | `npx -y flight-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y flight-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/flight-server.json) / [report](./safety-index/artifacts/flight-server.md) | Schema-only evaluation; requires flight API key (Amadeus/Skyscanner) for full search scan. Community package; verify npm availability. |
91
+ | 68 | [Hotel Booking MCP server](https://www.npmjs.com/package/hotel-booking-mcp) | Travel | **Not reproducible** | `rerun` | Hotel reservation boundary | `npx -y hotel-booking-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y hotel-booking-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/hotel-booking-server.json) / [report](./safety-index/artifacts/hotel-booking-server.md) | Schema-only evaluation; requires hotel API key for full booking scan. Community package; verify npm availability. |
92
+ | 69 | [OpenWeather MCP server](https://www.npmjs.com/package/openweather-mcp-server) | Weather | **Not reproducible** | `rerun` | Weather data boundary | `npx -y openweather-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y openweather-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/openweather-server.json) / [report](./safety-index/artifacts/openweather-server.md) | Schema-only evaluation; requires OpenWeather API key for full forecast scan. Community package; verify npm availability. |
93
+ | 70 | [Weather.com MCP server](https://www.npmjs.com/package/weather-mcp-server) | Weather | **Not reproducible** | `rerun` | Weather forecast boundary | `npx -y weather-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y weather-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/weather-server.json) / [report](./safety-index/artifacts/weather-server.md) | Schema-only evaluation; requires Weather API key for full forecast scan. Community package; verify npm availability. |
94
+ | 71 | [ESPN MCP server](https://www.npmjs.com/package/espn-mcp-server) | Sports | **Ready for CI** | `allow` | Sports content boundary | `npx -y espn-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y espn-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/espn-server.json) / [report](./safety-index/artifacts/espn-server.md) | Schema-only evaluation; requires ESPN API key for full data scan. Community package; verify npm availability. |
95
+ | 72 | [Spotify MCP server](https://www.npmjs.com/package/spotify-mcp-server) | Music | **Not reproducible** | `rerun` | Playback/library boundary | `npx -y spotify-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y spotify-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/spotify-server.json) / [report](./safety-index/artifacts/spotify-server.md) | Schema-only evaluation; requires Spotify OAuth credentials for full playback scan. Community package; verify npm availability. |
96
+ | 73 | [Apple Music MCP server](https://www.npmjs.com/package/apple-music-mcp) | Music | **Not reproducible** | `rerun` | Music library boundary | `npx -y apple-music-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y apple-music-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/apple-music-server.json) / [report](./safety-index/artifacts/apple-music-server.md) | Schema-only evaluation; requires Apple Music developer token for full catalog scan. Community package; verify npm availability. |
97
+ | 74 | [YouTube MCP server](https://www.npmjs.com/package/youtube-mcp-server) | Video | **Not reproducible** | `rerun` | Video content boundary | `npx -y youtube-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y youtube-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/youtube-server.json) / [report](./safety-index/artifacts/youtube-server.md) | Schema-only evaluation; requires YouTube Data API key for full search scan. Community package; verify npm availability. |
98
+ | 75 | [Vimeo MCP server](https://www.npmjs.com/package/vimeo-mcp-server) | Video | **Not reproducible** | `rerun` | Video management boundary | `npx -y vimeo-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y vimeo-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/vimeo-server.json) / [report](./safety-index/artifacts/vimeo-server.md) | Schema-only evaluation; requires Vimeo API access token for full scan. Community package; verify npm availability. |
99
+ | 76 | [ESLint MCP](https://www.npmjs.com/package/@eslint/mcp) | Developer Tools / Linting | **Ready for CI** | `allow` | Lint result boundary | `npx -y @eslint/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @eslint/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/eslint-mcp-server.json) / [report](./safety-index/artifacts/eslint-mcp-server.md) | Zero-config public package; 1 tool exposed for linting operations. |
100
+ | 77 | [CircleCI MCP](https://www.npmjs.com/package/@circleci/mcp-server-circleci) | CI/CD | **Unsafe default posture** | `escalate` | Pipeline/build boundary | `npx -y @circleci/mcp-server-circleci` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @circleci/mcp-server-circleci" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/circleci-server.json) / [report](./safety-index/artifacts/circleci-server.md) | Zero-config public package; 17 tools visible including pipeline, project, and workflow management. Schema-only for full operations without CircleCI API token. |
101
+ | 78 | [Heroku MCP](https://www.npmjs.com/package/@heroku/mcp-server) | Cloud Platform | **Unsafe default posture** | `quarantine` | App/dyno/addon boundary | `npx -y @heroku/mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @heroku/mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/heroku-server.json) / [report](./safety-index/artifacts/heroku-server.md) | Zero-config public package; 33 tools visible across apps, dynos, addons, pipelines, and more. High-risk tool surface visible without auth. |
102
+ | 79 | [Microsoft Clarity MCP](https://www.npmjs.com/package/@microsoft/clarity-mcp-server) | Analytics | **Ready for CI** | `allow` | Analytics/heatmap boundary | `npx -y @microsoft/clarity-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @microsoft/clarity-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/clarity-server.json) / [report](./safety-index/artifacts/clarity-server.md) | Zero-config public package; 3 tools exposed for analytics data access. Schema-only for actual data retrieval without Clarity API credentials. |
103
+ | 80 | [Qase Test Management MCP](https://www.npmjs.com/package/@qase/mcp-server) | Testing | **Unsafe default posture** | `quarantine` | Test case/result boundary | `npx -y @qase/mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @qase/mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/qase-server.json) / [report](./safety-index/artifacts/qase-server.md) | Zero-config public package; 80 tools visible. High tool count warrants careful review before agent integration. |
104
+ | 81 | [Coinbase Design System MCP](https://www.npmjs.com/package/@coinbase/cds-mcp-server) | Design System | **Ready for CI** | `allow` | Component/token boundary | `npx -y @coinbase/cds-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @coinbase/cds-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/coinbase-cds-server.json) / [report](./safety-index/artifacts/coinbase-cds-server.md) | Zero-config public package; 2 tools for design system component lookup and token reference. |
105
+ | 82 | [MUI MCP](https://www.npmjs.com/package/@mui/mcp) | Design System | **Ready for CI** | `allow` | Component/theme boundary | `npx -y @mui/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @mui/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/mui-mcp-server.json) / [report](./safety-index/artifacts/mui-mcp-server.md) | Zero-config public package; 2 tools for MUI component search and documentation lookup. |
106
+ | 83 | [Transcend Privacy MCP](https://www.npmjs.com/package/@transcend-io/mcp) | Privacy / Data Governance | **Ready for CI** | `gate` | DSR/consent/data boundary | `npx -y @transcend-io/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @transcend-io/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/transcend-server.json) / [report](./safety-index/artifacts/transcend-server.md) | Zero-config public package; 73 tools visible covering DSR, consent, preferences, inventory, discovery, and admin. High-risk privacy operations surface visible without auth. |
107
+ | 84 | [Azure MCP](https://www.npmjs.com/package/@azure/mcp) | Cloud | **Not reproducible** | `rerun` | Resource/provisioning boundary | `npx -y @azure/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @azure/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/azure-mcp-server.json) / [report](./safety-index/artifacts/azure-mcp-server.md) | Schema-only evaluation; requires Azure credentials for tool listing and full scan. |
108
+ | 85 | [Salesforce MCP](https://www.npmjs.com/package/@salesforce/mcp) | CRM | **Not reproducible** | `rerun` | Record/org/metadata boundary | `npx -y @salesforce/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @salesforce/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/salesforce-mcp-server.json) / [report](./safety-index/artifacts/salesforce-mcp-server.md) | Schema-only evaluation; requires Salesforce authentication for tool listing and full scan. |
109
+ | 86 | [Storybook MCP](https://www.npmjs.com/package/@storybook/mcp) | Design / Component Library | **Not reproducible** | `rerun` | Component/test boundary | `npx -y @storybook/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @storybook/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/storybook-mcp-server.json) / [report](./safety-index/artifacts/storybook-mcp-server.md) | Schema-only evaluation; requires a running Storybook instance for full functionality. |
110
+ | 87 | [Azure DevOps MCP](https://www.npmjs.com/package/@azure-devops/mcp) | DevOps / Project Management | **Not reproducible** | `rerun` | Work item/repo/pipeline boundary | `npx -y @azure-devops/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @azure-devops/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/azure-devops-mcp-server.json) / [report](./safety-index/artifacts/azure-devops-mcp-server.md) | Schema-only evaluation; requires Azure DevOps organization URL and PAT for full scan. |
111
+ | 88 | [HubSpot MCP](https://www.npmjs.com/package/@hubspot/mcp-server) | CRM / Marketing | **Not reproducible** | `rerun` | Contact/deal/campaign boundary | `npx -y @hubspot/mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @hubspot/mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/hubspot-mcp-server.json) / [report](./safety-index/artifacts/hubspot-mcp-server.md) | Schema-only evaluation; requires HubSpot access token for full scan. |
112
+ | 89 | [Dynatrace MCP](https://www.npmjs.com/package/@dynatrace-oss/dynatrace-mcp-server) | Monitoring / Observability | **Not reproducible** | `rerun` | Entity/metric/problem boundary | `npx -y @dynatrace-oss/dynatrace-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @dynatrace-oss/dynatrace-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/dynatrace-mcp-server.json) / [report](./safety-index/artifacts/dynatrace-mcp-server.md) | Schema-only evaluation; requires Dynatrace API token and environment URL for full scan. |
113
+ | 90 | [Brave Search MCP v2](https://www.npmjs.com/package/@brave/brave-search-mcp-server) | Search | **Not reproducible** | `rerun` | Web search/result boundary | `npx -y @brave/brave-search-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @brave/brave-search-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/brave-search-mcp-server-v2.json) / [report](./safety-index/artifacts/brave-search-mcp-server-v2.md) | Schema-only evaluation; requires Brave Search API key for full scan. |
114
+ | 91 | [SmartBear MCP](https://www.npmjs.com/package/@smartbear/mcp) | Testing / API Quality | **Unsafe default posture** | `gate` | Test/API/quality boundary | `npx -y @smartbear/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @smartbear/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/smartbear-mcp-server.json) / [report](./safety-index/artifacts/smartbear-mcp-server.md) | Schema-only evaluation; requires SmartBear API credentials for full scan. |
115
+ | 92 | [Argo CD MCP](https://www.npmjs.com/package/argocd-mcp) | Infrastructure / GitOps | **Not reproducible** | `rerun` | Application/sync/cluster boundary | `npx -y argocd-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y argocd-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/argocd-mcp-server.json) / [report](./safety-index/artifacts/argocd-mcp-server.md) | Schema-only evaluation; requires Argo CD server URL and auth token for full scan. |
116
+ | 93 | [Aikido Security MCP](https://www.npmjs.com/package/@aikidosec/mcp) | Security | **Ready for CI** | `allow` | Vulnerability/finding boundary | `npx -y @aikidosec/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @aikidosec/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/aikidosec-mcp-server.json) / [report](./safety-index/artifacts/aikidosec-mcp-server.md) | Schema-only evaluation; requires Aikido API credentials for full scan. |
117
+ | 94 | [Postman MCP](https://www.npmjs.com/package/@postman/postman-mcp-server) | API Testing / Development | **Not reproducible** | `rerun` | Collection/environment/request boundary | `npx -y @postman/postman-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @postman/postman-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/postman-mcp-server.json) / [report](./safety-index/artifacts/postman-mcp-server.md) | Schema-only evaluation; requires Postman API key for full scan. |
118
+ | 95 | [Shortcut MCP](https://www.npmjs.com/package/@shortcut/mcp) | Project Management | **Not reproducible** | `rerun` | Story/epic/workflow boundary | `npx -y @shortcut/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @shortcut/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/shortcut-mcp-server.json) / [report](./safety-index/artifacts/shortcut-mcp-server.md) | Schema-only evaluation; requires Shortcut API token for full scan. |
119
+ | 96 | [Cloudflare MCP v2](https://www.npmjs.com/package/@cloudflare/mcp-server-cloudflare) | Infrastructure | **Not reproducible** | `rerun` | DNS/worker/WAF boundary | `npx -y @cloudflare/mcp-server-cloudflare` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cloudflare/mcp-server-cloudflare" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cloudflare-mcp-server-v2.json) / [report](./safety-index/artifacts/cloudflare-mcp-server-v2.md) | Schema-only evaluation; requires Cloudflare API token for full scan. |
120
+ | 97 | [Apify MCP](https://www.npmjs.com/package/@apify/actors-mcp-server) | Web Scraping / Automation | **Not reproducible** | `rerun` | Actor/scraping/data boundary | `npx -y @apify/actors-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @apify/actors-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/apify-mcp-server.json) / [report](./safety-index/artifacts/apify-mcp-server.md) | Schema-only evaluation; requires Apify API token for full scan. |
121
+ | 98 | [ClickUp MCP](https://www.npmjs.com/package/@taazkareem/clickup-mcp-server) | Project Management | **Not reproducible** | `rerun` | Task/list/doc/chat boundary | `npx -y @taazkareem/clickup-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @taazkareem/clickup-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/clickup-mcp-server.json) / [report](./safety-index/artifacts/clickup-mcp-server.md) | Schema-only evaluation; requires ClickUp API token for full scan. |
122
+ | 99 | [Currents MCP](https://www.npmjs.com/package/@currents/mcp) | Testing / Playwright | **Not reproducible** | `rerun` | Test run/report boundary | `npx -y @currents/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @currents/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/currents-mcp-server.json) / [report](./safety-index/artifacts/currents-mcp-server.md) | Schema-only evaluation; requires Currents API credentials for full scan. |
123
+ | 100 | [Desktop Commander MCP](https://www.npmjs.com/package/@wonderwhy-er/desktop-commander) | Terminal / File System | **Unsafe default posture** | `quarantine` | Shell/exec/file boundary | `npx -y @wonderwhy-er/desktop-commander` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @wonderwhy-er/desktop-commander" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/desktop-commander-mcp-server.json) / [report](./safety-index/artifacts/desktop-commander-mcp-server.md) | Schema-only evaluation; requires a specific runtime environment for tool listing. Shell execution boundary requires explicit sandboxing review. |
124
+ | 101 | [WhatsApp MCP](https://github.com/lharries/whatsapp-mcp) | Messaging | **Not reproducible** | `rerun` | Message/session boundary | `npx -y whatsapp-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y whatsapp-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/whatsapp-mcp-server.json) / [report](./safety-index/artifacts/whatsapp-mcp-server.md) | Schema-only evaluation; requires WhatsApp Web session setup via QR code for full message operations. |
125
+ | 102 | [Shopify MCP](https://github.com/GeLi2001/shopify-mcp) | E-commerce | **Not reproducible** | `rerun` | Product/order boundary | `npx -y shopify-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y shopify-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/shopify-mcp-server.json) / [report](./safety-index/artifacts/shopify-mcp-server.md) | Schema-only; requires Shopify store domain and Storefront API access token. |
126
+ | 103 | [MySQL MCP Server](https://www.npmjs.com/package/mysql-mcp-server) | Database | **Not reproducible** | `rerun` | SQL query boundary (MySQL) | `npx -y mysql-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mysql-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/mysql-mcp-server.json) / [report](./safety-index/artifacts/mysql-mcp-server.md) | Schema-only evaluation; requires MySQL connection string and credentials for full scan. |
127
+ | 104 | [Redis MCP Server](https://www.npmjs.com/package/mcp-server-redis) | Database | **Not reproducible** | `rerun` | Key/value mutation boundary | `npx -y mcp-server-redis` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-redis" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/redis-server.json) / [report](./safety-index/artifacts/redis-server.md) | Schema-only; requires Redis connection URL for full scan. |
128
+ | 105 | [DynamoDB MCP Server](https://www.npmjs.com/package/mcp-server-dynamodb) | Database / Cloud | **Not reproducible** | `rerun` | Table/item mutation boundary | `npx -y mcp-server-dynamodb` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-dynamodb" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/dynamodb-mcp-server.json) / [report](./safety-index/artifacts/dynamodb-mcp-server.md) | Schema-only; requires AWS credentials and region configuration for full scan. |
129
+ | 106 | [S3 MCP Server](https://www.npmjs.com/package/mcp-server-s3) | Cloud Storage | **Ready for CI** | `allow` | Bucket/object boundary | `npx -y mcp-server-s3` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-s3" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/s3-mcp-server.json) / [report](./safety-index/artifacts/s3-mcp-server.md) | Schema-only; requires AWS credentials and bucket configuration for full scan. |
130
+ | 107 | [AWS MCP Server](https://www.npmjs.com/package/mcp-server-aws) | Cloud | **Not reproducible** | `rerun` | AWS service boundary | `npx -y mcp-server-aws` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-aws" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/aws-mcp-server.json) / [report](./safety-index/artifacts/aws-mcp-server.md) | Schema-only; requires AWS credentials and region for full scan. |
131
+ | 108 | [GCP MCP Server](https://www.npmjs.com/package/mcp-server-gcp) | Cloud | **Not reproducible** | `rerun` | GCP service boundary | `npx -y mcp-server-gcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-gcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/gcp-mcp-server.json) / [report](./safety-index/artifacts/gcp-mcp-server.md) | Schema-only; requires GCP credentials and project configuration for full scan. |
132
+ | 109 | [Shopify MCP](https://www.npmjs.com/package/shopify-mcp) | E-commerce | **Not reproducible** | `rerun` | Store/product/order boundary | `npx -y shopify-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y shopify-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/shopify-mcp.json) / [report](./safety-index/artifacts/shopify-mcp.md) | Schema-only; requires Shopify store credentials and access token for full scan. |
133
+ | 110 | [Telegram MCP Server](https://www.npmjs.com/package/telegram-mcp-server) | Communication | **Not reproducible** | `rerun` | Message/chat boundary | `npx -y telegram-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y telegram-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/telegram-mcp-server.json) / [report](./safety-index/artifacts/telegram-mcp-server.md) | Schema-only; requires Telegram bot token for full scan. |
134
+ | 111 | [WhatsApp MCP](https://www.npmjs.com/package/whatsapp-mcp) | Communication | **Not reproducible** | `rerun` | Message boundary (WhatsApp) | `npx -y whatsapp-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y whatsapp-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/whatsapp-mcp.json) / [report](./safety-index/artifacts/whatsapp-mcp.md) | Schema-only; requires WhatsApp Business API credentials for full scan. |
135
+ | 112 | [Twilio MCP](https://www.npmjs.com/package/twilio-mcp) | Communication | **Not reproducible** | `rerun` | SMS/voice/chat boundary | `npx -y twilio-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y twilio-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/twilio-mcp.json) / [report](./safety-index/artifacts/twilio-mcp.md) | Schema-only; requires Twilio account SID and auth token for full scan. |
136
+ | 113 | [SendGrid MCP](https://www.npmjs.com/package/sendgrid-mcp) | Email / Communication | **Not reproducible** | `rerun` | Email send/template boundary | `npx -y sendgrid-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y sendgrid-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sendgrid-mcp.json) / [report](./safety-index/artifacts/sendgrid-mcp.md) | Schema-only; requires SendGrid API key for full scan. |
137
+ | 114 | [OpenAI MCP Server](https://www.npmjs.com/package/openai-mcp-server) | AI / ML Platform | **Not reproducible** | `rerun` | Model inference boundary | `npx -y openai-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y openai-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/openai-mcp-server.json) / [report](./safety-index/artifacts/openai-mcp-server.md) | Schema-only; requires OpenAI API key for full scan. |
138
+ | 115 | [Perplexity MCP](https://www.npmjs.com/package/perplexity-mcp) | Search / AI | **Not reproducible** | `rerun` | Search result/LLM boundary | `npx -y perplexity-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y perplexity-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/perplexity-mcp.json) / [report](./safety-index/artifacts/perplexity-mcp.md) | Schema-only; requires Perplexity API key for full scan. |
139
+ | 116 | [Langfuse MCP](https://www.npmjs.com/package/langfuse-mcp) | AI / ML Observability | **Not reproducible** | `rerun` | Trace/observation data boundary | `npx -y langfuse-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y langfuse-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/langfuse-mcp.json) / [report](./safety-index/artifacts/langfuse-mcp.md) | Schema-only; requires Langfuse API keys for full scan. |
140
+ | 117 | [Jira MCP Server](https://www.npmjs.com/package/jira-mcp-server) | Project Management | **Not reproducible** | `rerun` | Issue/board/sprint boundary | `npx -y jira-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y jira-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/jira-mcp-server.json) / [report](./safety-index/artifacts/jira-mcp-server.md) | Schema-only; requires Jira API token and instance URL for full scan. |
141
+ | 118 | [Confluence MCP Server](https://www.npmjs.com/package/confluence-mcp-server) | Productivity / Docs | **Unsafe default posture** | `gate` | Page/space boundary | `npx -y confluence-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y confluence-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/confluence-mcp-server.json) / [report](./safety-index/artifacts/confluence-mcp-server.md) | Schema-only; requires Confluence API token and instance URL for full scan. |
142
+ | 119 | [Trello MCP Server](https://www.npmjs.com/package/trello-mcp-server) | Project Management | **Needs review before production** | `gate` | Board/card/list boundary | `npx -y trello-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y trello-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/trello-mcp-server.json) / [report](./safety-index/artifacts/trello-mcp-server.md) | Tool listing succeeds without auth. Full operations require Trello API key and token. |
143
+ | 120 | [Zendesk MCP](https://www.npmjs.com/package/zendesk-mcp) | Support / CRM | **Not reproducible** | `rerun` | Ticket/user/knowledge boundary | `npx -y zendesk-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y zendesk-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/zendesk-mcp.json) / [report](./safety-index/artifacts/zendesk-mcp.md) | Schema-only; requires Zendesk subdomain and API token for full scan. |
144
+ | 121 | [Spotify MCP](https://www.npmjs.com/package/spotify-mcp) | Media / Entertainment | **Ready for CI** | `gate` | Playback/playlist boundary | `npx -y spotify-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y spotify-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/spotify-mcp.json) / [report](./safety-index/artifacts/spotify-mcp.md) | Tool listing succeeds without auth. Full operations require Spotify OAuth credentials. |
145
+ | 122 | [Airtable MCP Server](https://www.npmjs.com/package/airtable-mcp-server) | Productivity / Database | **Not reproducible** | `rerun` | Base/table/record boundary | `npx -y airtable-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y airtable-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/airtable-mcp-server.json) / [report](./safety-index/artifacts/airtable-mcp-server.md) | Schema-only; requires Airtable personal access token for full scan. |
146
+ | 123 | [Obsidian MCP](https://www.npmjs.com/package/obsidian-mcp) | Productivity / Knowledge | **Not reproducible** | `rerun` | Note/vault/file boundary | `npx -y obsidian-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y obsidian-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/obsidian-mcp.json) / [report](./safety-index/artifacts/obsidian-mcp.md) | Schema-only; requires vault path configuration for full scan. |
147
+ | 124 | [arXiv MCP Server](https://www.npmjs.com/package/arxiv-mcp-server) | Academic / Search | **Not reproducible** | `rerun` | Paper metadata/search boundary | `npx -y arxiv-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y arxiv-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/arxiv-mcp-server.json) / [report](./safety-index/artifacts/arxiv-mcp-server.md) | Read-only public API; tool listing may succeed without auth. |
148
+ | 125 | [Resend MCP](https://www.npmjs.com/package/resend-mcp) | Email / Communication | **Not reproducible** | `rerun` | Email send/domain boundary | `npx -y resend-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y resend-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/resend-mcp.json) / [report](./safety-index/artifacts/resend-mcp.md) | Schema-only; requires Resend API key for full scan. |
149
+ | 126 | [Discord MCP (v2)](https://www.npmjs.com/package/discord-mcp) | Communication | **Ready for CI** | `gate` | Server/channel/message boundary | `npx -y discord-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y discord-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/discord-mcp.json) / [report](./safety-index/artifacts/discord-mcp.md) | Tool listing succeeds without auth. Full operations require Discord bot token. |
150
+ | 127 | [Stock NSE India](https://www.npmjs.com/package/stock-nse-india-mcp) | Finance / Indian Markets | **Not reproducible** | `rerun` | NSE market data boundary | `npx -y stock-nse-india-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y stock-nse-india-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/stock-nse-india.json) / [report](./safety-index/artifacts/stock-nse-india.md) | Schema-only evaluation; may require NSE API credentials. Community package — exact npm name pending verification. |
151
+ | 128 | [Razorpay MCP](https://www.npmjs.com/package/razorpay-mcp) | Payments / Indian Fintech | **Not reproducible** | `rerun` | Payment/refund/settlement boundary | `npx -y razorpay-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y razorpay-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/razorpay-mcp.json) / [report](./safety-index/artifacts/razorpay-mcp.md) | Schema-only evaluation; requires Razorpay key ID and secret. Community package — exact npm name pending verification. |
152
+ | 129 | [Paytm MCP](https://www.npmjs.com/package/paytm-mcp) | Payments / Indian Fintech | **Not reproducible** | `rerun` | Wallet/payment gateway boundary | `npx -y paytm-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y paytm-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/paytm-mcp.json) / [report](./safety-index/artifacts/paytm-mcp.md) | Schema-only evaluation; requires Paytm merchant credentials. Community package — exact npm name pending verification. |
153
+ | 130 | [UPI MCP](https://www.npmjs.com/package/upi-mcp) | Payments / Indian Fintech | **Ready for CI** | `allow` | UPI transaction/bank boundary | `npx -y upi-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y upi-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/upi-mcp.json) / [report](./safety-index/artifacts/upi-mcp.md) | Verified npm package exists and starts on stdio. Schema-only evaluation; requires UPI API/direct payment integration credentials for full scan. |
154
+ | 131 | [Aadhaar MCP](https://www.npmjs.com/package/aadhaar-mcp) | Identity / Indian Gov | **Not reproducible** | `rerun` | Identity verification/KYC boundary | `npx -y aadhaar-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y aadhaar-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/aadhaar-mcp.json) / [report](./safety-index/artifacts/aadhaar-mcp.md) | Schema-only evaluation; requires UIDAI-authorized API credentials. Community package — exact npm name pending verification. |
155
+ | 132 | [DigiLocker MCP](https://www.npmjs.com/package/digilocker-mcp) | Identity / Indian Gov | **Not reproducible** | `rerun` | Document retrieval/verification boundary | `npx -y digilocker-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y digilocker-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/digilocker-mcp.json) / [report](./safety-index/artifacts/digilocker-mcp.md) | Schema-only evaluation; requires DigiLocker API integration credentials. Community package — exact npm name pending verification. |
156
+ | 133 | [Udyam MCP](https://www.npmjs.com/package/udyam-mcp) | Business / Indian Gov | **Not reproducible** | `rerun` | Business registration/verification boundary | `npx -y udyam-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y udyam-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/udyam-mcp.json) / [report](./safety-index/artifacts/udyam-mcp.md) | Schema-only evaluation; requires Udyam API portal credentials. Community package — exact npm name pending verification. |
157
+ | 134 | [GST MCP](https://www.npmjs.com/package/gst-mcp) | Tax / Indian Gov | **Not reproducible** | `rerun` | GST return/invoice/billing boundary | `npx -y gst-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y gst-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/gst-mcp.json) / [report](./safety-index/artifacts/gst-mcp.md) | Schema-only evaluation; requires GSTN API credentials and digital signature. Community package — exact npm name pending verification. |
158
+ | 135 | [WhatsApp Business MCP](https://www.npmjs.com/package/whatsapp-business-mcp) | Communication / Indian | **Not reproducible** | `rerun` | Message/template/contact boundary | `npx -y whatsapp-business-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y whatsapp-business-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/whatsapp-business-mcp.json) / [report](./safety-index/artifacts/whatsapp-business-mcp.md) | Schema-only evaluation; requires WhatsApp Business API credentials (WABA). Community package — exact npm name pending verification. |
159
+ | 136 | [Gupshup MCP](https://www.npmjs.com/package/gupshup-mcp) | Communication / Indian | **Not reproducible** | `rerun` | Multi-channel message boundary | `npx -y gupshup-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y gupshup-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/gupshup-mcp.json) / [report](./safety-index/artifacts/gupshup-mcp.md) | Schema-only evaluation; requires Gupshup API key. Community package — exact npm name pending verification. |
160
+ | 137 | [Textlocal MCP](https://www.npmjs.com/package/textlocal-mcp) | Communication / Indian | **Not reproducible** | `rerun` | SMS/campaign boundary | `npx -y textlocal-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y textlocal-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/textlocal-mcp.json) / [report](./safety-index/artifacts/textlocal-mcp.md) | Schema-only evaluation; requires Textlocal API key and DLT registration. Community package — exact npm name pending verification. |
161
+ | 138 | [MapMyIndia MCP](https://www.npmjs.com/package/mapmyindia-mcp) | Maps / Indian | **Not reproducible** | `rerun` | Map/routing/geocode boundary | `npx -y mapmyindia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mapmyindia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/mapmyindia-mcp.json) / [report](./safety-index/artifacts/mapmyindia-mcp.md) | Schema-only evaluation; requires MapMyIndia API key and license. Community package — exact npm name pending verification. |
162
+ | 139 | [Ola Maps MCP](https://www.npmjs.com/package/ola-maps-mcp) | Maps / Indian | **Not reproducible** | `rerun` | Maps/routing/ride boundary | `npx -y ola-maps-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ola-maps-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ola-maps-mcp.json) / [report](./safety-index/artifacts/ola-maps-mcp.md) | Schema-only evaluation; requires Ola Maps API credentials. Community package — exact npm name pending verification. |
163
+ | 140 | [Postman MCP (Indian region)](https://www.npmjs.com/package/@postman/postman-mcp-server) | API Testing / Indian Development | **Not reproducible** | `rerun` | Collection/environment/request boundary | `npx -y @postman/postman-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @postman/postman-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/postman-india-region.json) / [report](./safety-index/artifacts/postman-india-region.md) | Already evaluated at existing entry #94. Verified npm package exists; requires POSTMAN_API_KEY for full scan. Included here for Indian-region coverage completeness. |
164
+ | 141 | [Hasura MCP](https://www.npmjs.com/package/hasura-mcp) | Database / Indian OSS | **Not reproducible** | `rerun` | GraphQL/Database query boundary | `npx -y hasura-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y hasura-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/hasura-mcp.json) / [report](./safety-index/artifacts/hasura-mcp.md) | Schema-only evaluation; requires Hasura admin secret and endpoint. Community package — exact npm name pending verification. |
165
+ | 142 | [ToolJet MCP](https://www.npmjs.com/package/tooljet-mcp) | Internal Tools / Indian OSS | **Not reproducible** | `rerun` | App/datasource/workflow boundary | `npx -y tooljet-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y tooljet-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/tooljet-mcp.json) / [report](./safety-index/artifacts/tooljet-mcp.md) | Schema-only evaluation; requires ToolJet instance URL and auth token. Community package — exact npm name pending verification. |
166
+ | 143 | [Appwrite MCP](https://www.npmjs.com/package/appwrite-mcp) | Backend / Indian OSS | **Not reproducible** | `rerun` | Database/auth/storage/function boundary | `npx -y appwrite-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y appwrite-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/appwrite-mcp.json) / [report](./safety-index/artifacts/appwrite-mcp.md) | Schema-only evaluation; requires Appwrite endpoint and API key. Community package — exact npm name pending verification. |
167
+ | 144 | [Chatwoot MCP](https://www.npmjs.com/package/chatwoot-mcp) | CRM / Indian OSS | **Not reproducible** | `rerun` | Conversation/contact/inbox boundary | `npx -y chatwoot-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y chatwoot-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/chatwoot-mcp.json) / [report](./safety-index/artifacts/chatwoot-mcp.md) | Package appears to exist but may require server connection. Schema-only evaluation; requires Chatwoot instance URL and API token. Community package — exact npm name pending verification. |
168
+ | 145 | [Cal.com MCP](https://www.npmjs.com/package/cal-com-mcp) | Scheduling / Indian OSS | **Not reproducible** | `rerun` | Booking/availability/calendar boundary | `npx -y cal-com-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y cal-com-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cal-com-mcp.json) / [report](./safety-index/artifacts/cal-com-mcp.md) | Schema-only evaluation; requires Cal.com API key. Community package — exact npm name pending verification. |
169
+ | 146 | [Indian Food Nutrition MCP](https://www.npmjs.com/package/indian-food-nutrition-mcp) | Food / Indian | **Ready for CI** | `gate` | Nutrition/ingredient/dietary boundary | `npx -y indian-food-nutrition-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y indian-food-nutrition-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/indian-food-nutrition-mcp.json) / [report](./safety-index/artifacts/indian-food-nutrition-mcp.md) | Schema-only evaluation; model inference on Indian cuisine data. Community package — exact npm name pending verification. |
170
+ | 147 | [Ayushman Bharat Healthcare MCP](https://www.npmjs.com/package/healthcare-ayushman-bharat-mcp) | Healthcare / Indian Gov | **Not reproducible** | `rerun` | Patient/claim/hospital boundary | `npx -y healthcare-ayushman-bharat-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y healthcare-ayushman-bharat-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/healthcare-ayushman-bharat-mcp.json) / [report](./safety-index/artifacts/healthcare-ayushman-bharat-mcp.md) | Schema-only evaluation; requires NHA (National Health Authority) API credentials. Community package — exact npm name pending verification. |
171
+ | 148 | [IRCTC MCP](https://www.npmjs.com/package/irctc-mcp) | Travel / Indian Railways | **Not reproducible** | `rerun` | Ticket booking/PNR/availability boundary | `npx -y irctc-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y irctc-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/irctc-mcp.json) / [report](./safety-index/artifacts/irctc-mcp.md) | Schema-only evaluation; requires IRCTC API credentials (authorized agent). Community package — exact npm name pending verification. |
172
+ | 149 | [AQI India MCP](https://www.npmjs.com/package/aqi-india-mcp) | Environment / Indian | **Not reproducible** | `rerun` | Environmental data/health boundary | `npx -y aqi-india-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y aqi-india-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/aqi-india-mcp.json) / [report](./safety-index/artifacts/aqi-india-mcp.md) | Schema-only evaluation; requires CPCB/SAFAR API credentials or OpenAQ data source. Community package — exact npm name pending verification. |
173
+ | 150 | [CoWIN MCP](https://www.npmjs.com/package/cowin-mcp) | Healthcare / Indian Gov | **Not reproducible** | `rerun` | Beneficiary/dose/certificate boundary | `npx -y cowin-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y cowin-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cowin-mcp.json) / [report](./safety-index/artifacts/cowin-mcp.md) | Schema-only evaluation; CoWIN public APIs are read-only and no longer require auth for some endpoints. Community package — exact npm name pending verification. |
174
+ | 151 | [Bhuvan MCP](https://www.npmjs.com/package/bhuvan-mcp) | Geospatial / Indian Gov | **Not reproducible** | `rerun` | Satellite imagery/geospatial data boundary | `npx -y bhuvan-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y bhuvan-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/bhuvan-mcp.json) / [report](./safety-index/artifacts/bhuvan-mcp.md) | Schema-only evaluation; requires Bhuvan/ISRO API credentials. Community package — exact npm name pending verification. |
175
+ | 152 | [Sehat Sahulat MCP](https://www.npmjs.com/package/sehat-sahulat-mcp) | Healthcare / Pakistan Gov | **Not reproducible** | `rerun` | Insurance claim/beneficiary boundary | `npx -y sehat-sahulat-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y sehat-sahulat-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sehat-sahulat-mcp.json) / [report](./safety-index/artifacts/sehat-sahulat-mcp.md) | Schema-only evaluation; requires Sehat Sahulat program / provincial health authority API credentials. Community package — exact npm name pending verification. |
176
+ | 153 | [Ehsaas MCP](https://www.npmjs.com/package/ehsaas-mcp) | Social Welfare / Pakistan Gov | **Not reproducible** | `rerun` | Beneficiary/cash-transfer boundary | `npx -y ehsaas-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ehsaas-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ehsaas-mcp.json) / [report](./safety-index/artifacts/ehsaas-mcp.md) | Schema-only evaluation; requires Ehsaas / BISP (Benazir Income Support Programme) API credentials. Community package — exact npm name pending verification. |
177
+ | 154 | [PIMS MCP](https://www.npmjs.com/package/pims-mcp) | Healthcare / Pakistan Gov | **Not reproducible** | `rerun` | Patient record/hospital management boundary | `npx -y pims-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y pims-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/pims-mcp.json) / [report](./safety-index/artifacts/pims-mcp.md) | Schema-only evaluation; requires PIMS hospital information system / Ministry of NHSRC API credentials. Community package — exact npm name pending verification. |
178
+ | 155 | [Punjab Health MCP](https://www.npmjs.com/package/punjab-health-mcp) | Healthcare / Pakistan Gov | **Not reproducible** | `rerun` | Health service/disease surveillance boundary | `npx -y punjab-health-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y punjab-health-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/punjab-health-mcp.json) / [report](./safety-index/artifacts/punjab-health-mcp.md) | Schema-only evaluation; requires Punjab Health Department / DHIS2 API credentials. Community package — exact npm name pending verification. |
179
+ | 156 | [Pakistan Weather MCP](https://www.npmjs.com/package/pakistan-weather-mcp) | Weather / Pakistan Gov | **Not reproducible** | `rerun` | Weather/forecast/disaster boundary | `npx -y pakistan-weather-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y pakistan-weather-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/pakistan-weather-mcp.json) / [report](./safety-index/artifacts/pakistan-weather-mcp.md) | Schema-only evaluation; requires Pakistan Meteorological Department API credentials. Community package — exact npm name pending verification. |
180
+ | 157 | [Jazz MCP](https://www.npmjs.com/package/jazz-mcp) | Communication / Pakistani | **Not reproducible** | `rerun` | SMS/voice/network boundary | `npx -y jazz-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y jazz-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/jazz-mcp.json) / [report](./safety-index/artifacts/jazz-mcp.md) | Schema-only evaluation; package not yet published to npm. Community package — exact npm name pending verification. |
181
+ | 158 | [Zong MCP](https://www.npmjs.com/package/zong-mcp) | Communication / Pakistani | **Not reproducible** | `rerun` | SMS/voice/data boundary | `npx -y zong-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y zong-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/zong-mcp.json) / [report](./safety-index/artifacts/zong-mcp.md) | Schema-only evaluation; package not yet published to npm. Community package — exact npm name pending verification. |
182
+ | 159 | [Telenor Pakistan MCP](https://www.npmjs.com/package/telenor-pakistan-mcp) | Communication / Pakistani | **Not reproducible** | `rerun` | SMS/vas/digital boundary | `npx -y telenor-pakistan-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y telenor-pakistan-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/telenor-pakistan-mcp.json) / [report](./safety-index/artifacts/telenor-pakistan-mcp.md) | Schema-only evaluation; package not yet published to npm. Community package — exact npm name pending verification. |
183
+ | 160 | [Ufone MCP](https://www.npmjs.com/package/ufone-mcp) | Communication / Pakistani | **Not reproducible** | `rerun` | SMS/voice/fiber boundary | `npx -y ufone-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ufone-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ufone-mcp.json) / [report](./safety-index/artifacts/ufone-mcp.md) | Schema-only evaluation; package not yet published to npm. Community package — exact npm name pending verification. |
184
+ | 161 | [Pakistan Post MCP](https://www.npmjs.com/package/pakistan-post-mcp) | Maps / Logistics / Pakistani | **Not reproducible** | `rerun` | Tracking/delivery/geocode boundary | `npx -y pakistan-post-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y pakistan-post-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/pakistan-post-mcp.json) / [report](./safety-index/artifacts/pakistan-post-mcp.md) | Schema-only evaluation; package not yet published to npm. Community package — exact npm name pending verification. |
185
+ | 162 | [JazzCash MCP](https://github.com/theYahia/jazzcash-mcp) | Payments / Pakistani Fintech | **Not reproducible** | `rerun` | Payment/wallet/OTC boundary | `npx -y @theyahia/jazzcash-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @theyahia/jazzcash-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/jazzcash-mcp.json) / [report](./safety-index/artifacts/jazzcash-mcp.md) | Verified npm package @theyahia/jazzcash-mcp (v2.0.1). Schema-only evaluation; requires JazzCash API/merchant credentials for full scan. |
186
+ | 163 | [EasyPaisa MCP](https://github.com/theYahia/easypaisa-mcp) | Payments / Pakistani Fintech | **Ready for CI** | `allow` | Mobile wallet/payment gateway boundary | `npx -y @theyahia/easypaisa-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @theyahia/easypaisa-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/easypaisa-mcp.json) / [report](./safety-index/artifacts/easypaisa-mcp.md) | Verified npm package @theyahia/easypaisa-mcp (v1.0.1). Schema-only evaluation; requires EasyPaisa API credentials for full scan. |
187
+ | 164 | [NADRA MCP](https://www.npmjs.com/package/nadra-mcp) | Identity / Pakistani Gov | **Not reproducible** | `rerun` | Identity verification/CNIC boundary | `npx -y nadra-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y nadra-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/nadra-mcp.json) / [report](./safety-index/artifacts/nadra-mcp.md) | Schema-only evaluation; community package — exact npm name pending verification. Requires NADRA-authorized API credentials. |
188
+ | 165 | [FBR MCP](https://www.npmjs.com/package/fbr-mcp) | Tax / Pakistani Gov | **Not reproducible** | `rerun` | Tax return/NTN/invoice boundary | `npx -y fbr-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y fbr-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/fbr-mcp.json) / [report](./safety-index/artifacts/fbr-mcp.md) | Schema-only evaluation; community package — exact npm name pending verification. Requires FBR IRIS API credentials and digital signature. |
189
+ | 166 | [1LINK MCP](https://www.npmjs.com/package/1link-mcp) | Payments / Pakistani Fintech | **Not reproducible** | `rerun` | Interbank transaction/switch boundary | `npx -y 1link-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y 1link-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/1link-mcp.json) / [report](./safety-index/artifacts/1link-mcp.md) | Schema-only evaluation; community package — exact npm name pending verification. Requires 1LINK-authorized API credentials. |
190
+ | 167 | [AIOU MCP](https://www.npmjs.com/package/aiou-mcp) | Education / Pakistan | **Not reproducible** | `rerun` | Student/enrollment/grade boundary | `npx -y aiou-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y aiou-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/aiou-mcp.json) / [report](./safety-index/artifacts/aiou-mcp.md) | Schema-only evaluation; requires AIOU API credentials. Community package — exact npm name pending verification. |
191
+ | 168 | [HEC Pakistan MCP](https://www.npmjs.com/package/hec-pakistan-mcp) | Education / Pakistan Gov | **Not reproducible** | `rerun` | Degree/university/attestation boundary | `npx -y hec-pakistan-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y hec-pakistan-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/hec-pakistan-mcp.json) / [report](./safety-index/artifacts/hec-pakistan-mcp.md) | Schema-only evaluation; requires HEC Pakistan API credentials. Community package — exact npm name pending verification. |
192
+ | 169 | [Pakistan Cricket MCP](https://www.npmjs.com/package/pakistan-cricket-mcp) | Sports / Pakistan | **Not reproducible** | `rerun` | Match/player/statistics boundary | `npx -y pakistan-cricket-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y pakistan-cricket-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/pakistan-cricket-mcp.json) / [report](./safety-index/artifacts/pakistan-cricket-mcp.md) | Schema-only evaluation; requires PCB API credentials. Community package — exact npm name pending verification. |
193
+ | 170 | [K2 MCP](https://www.npmjs.com/package/k2-mcp) | Mountaineering / Pakistan | **Not reproducible** | `rerun` | Permit/expedition/safety boundary | `npx -y k2-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y k2-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/k2-mcp.json) / [report](./safety-index/artifacts/k2-mcp.md) | Schema-only evaluation; requires Alpine Club of Pakistan/GB Council permit API credentials. Community package — exact npm name pending verification. |
194
+ | 171 | [Bhuvan MCP](https://www.npmjs.com/package/bhuvan-mcp) | Geospatial / Indian Gov | **Not reproducible** | `rerun` | Satellite imagery/geospatial data boundary | `npx -y bhuvan-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y bhuvan-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/bhuvan-mcp.json) / [report](./safety-index/artifacts/bhuvan-mcp.md) | Schema-only evaluation; requires Bhuvan/ISRO API credentials. Community package — exact npm name pending verification. |
195
+ | 172 | [Rozgar.com MCP](https://www.npmjs.com/package/rozgar-mcp) | Jobs / Pakistani | **Not reproducible** | `rerun` | Job listing/application/candidate boundary | `npx -y rozgar-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y rozgar-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/rozgar-mcp.json) / [report](./safety-index/artifacts/rozgar-mcp.md) | Schema-only evaluation; requires Rozgar.com API credentials. Community package — exact npm name pending verification. |
196
+ | 173 | [Foodpanda Pakistan MCP](https://www.npmjs.com/package/foodpanda-pakistan-mcp) | Food Delivery / Pakistani | **Not reproducible** | `rerun` | Order/restaurant/delivery boundary | `npx -y foodpanda-pakistan-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y foodpanda-pakistan-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/foodpanda-pakistan-mcp.json) / [report](./safety-index/artifacts/foodpanda-pakistan-mcp.md) | Schema-only evaluation; requires Foodpanda Pakistan API credentials. Community package — exact npm name pending verification. |
197
+ | 174 | [Daraz MCP](https://github.com/shaheedghazi/daraz-mcp) | E-commerce / Pakistani | **Not reproducible** | `rerun` | Product/order/seller boundary | `npx -y daraz-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y daraz-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/daraz-mcp.json) / [report](./safety-index/artifacts/daraz-mcp.md) | Schema-only evaluation; requires Daraz Open Platform API credentials. Community package — exact npm name pending verification. |
198
+ | 175 | [OLX Pakistan MCP](https://www.npmjs.com/package/olx-pakistan-mcp) | Classifieds / Pakistani | **Not reproducible** | `rerun` | Listing/ad/user boundary | `npx -y olx-pakistan-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y olx-pakistan-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/olx-pakistan-mcp.json) / [report](./safety-index/artifacts/olx-pakistan-mcp.md) | Schema-only evaluation; requires OLX Pakistan API credentials. Community package — exact npm name pending verification. |
199
+ | 176 | [PakWheels MCP](https://www.npmjs.com/package/pakwheels-mcp) | Auto Marketplace / Pakistani | **Not reproducible** | `rerun` | Vehicle/listing/dealer boundary | `npx -y pakwheels-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y pakwheels-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/pakwheels-mcp.json) / [report](./safety-index/artifacts/pakwheels-mcp.md) | Schema-only evaluation; requires PakWheels API credentials. Community package — exact npm name pending verification. |
43
200
 
44
201
  ## Patterns Observed
45
202
 
46
203
  - Browser/code execution boundary: 3 server(s)
204
+ - Search result boundary: 3 server(s)
205
+ - Collection/environment/request boundary: 2 server(s)
206
+ - Model inference boundary: 2 server(s)
207
+ - Satellite imagery/geospatial data boundary: 2 server(s)
208
+ - Actor/scraping/data boundary: 1 server(s)
209
+ - Analytics/heatmap boundary: 1 server(s)
210
+ - App/datasource/workflow boundary: 1 server(s)
211
+ - App/dyno/addon boundary: 1 server(s)
212
+ - Application/sync/cluster boundary: 1 server(s)
47
213
  - Artifact-producing tools: 1 server(s)
214
+ - AWS service boundary: 1 server(s)
215
+ - Base/table/record boundary: 1 server(s)
216
+ - Beneficiary/cash-transfer boundary: 1 server(s)
217
+ - Beneficiary/dose/certificate boundary: 1 server(s)
218
+ - Board/card/list boundary: 1 server(s)
219
+ - Booking/availability/calendar boundary: 1 server(s)
48
220
  - Broad protocol surface: 1 server(s)
49
221
  - Browser-control boundary: 1 server(s)
222
+ - Bucket/object boundary: 1 server(s)
223
+ - Business registration/verification boundary: 1 server(s)
224
+ - Calendar event boundary: 1 server(s)
225
+ - Collection/point boundary: 1 server(s)
50
226
  - Command and cluster mutation boundary: 1 server(s)
227
+ - Component/test boundary: 1 server(s)
228
+ - Component/theme boundary: 1 server(s)
229
+ - Component/token boundary: 1 server(s)
230
+ - Contact/deal/campaign boundary: 1 server(s)
231
+ - Contact/relationship boundary: 1 server(s)
232
+ - Container/image boundary: 1 server(s)
233
+ - Content posting/reading boundary: 1 server(s)
234
+ - Conversation/contact/inbox boundary: 1 server(s)
235
+ - Course/grade boundary: 1 server(s)
236
+ - Data query/collection boundary: 1 server(s)
237
+ - Database/auth/admin boundary: 1 server(s)
238
+ - Database/auth/storage/function boundary: 1 server(s)
239
+ - Database/branch boundary: 1 server(s)
240
+ - Degree/university/attestation boundary: 1 server(s)
241
+ - Deployment/project boundary: 1 server(s)
242
+ - Design/file boundary: 1 server(s)
243
+ - DNS/worker/deployment boundary: 1 server(s)
244
+ - DNS/worker/WAF boundary: 1 server(s)
245
+ - Document analysis boundary: 1 server(s)
246
+ - Document retrieval/verification boundary: 1 server(s)
247
+ - Document/permission boundary: 1 server(s)
248
+ - DSR/consent/data boundary: 1 server(s)
249
+ - EHR record boundary: 1 server(s)
250
+ - Email read/write boundary: 1 server(s)
251
+ - Email send/domain boundary: 1 server(s)
252
+ - Email send/template boundary: 1 server(s)
253
+ - Entity/metric/problem boundary: 1 server(s)
254
+ - Environmental data/health boundary: 1 server(s)
255
+ - Financial transaction tool boundary: 1 server(s)
256
+ - Flight search boundary: 1 server(s)
51
257
  - Framework tooling boundary: 1 server(s)
258
+ - Game engine boundary: 1 server(s)
259
+ - Game state boundary: 1 server(s)
260
+ - GCP service boundary: 1 server(s)
52
261
  - Git tool boundary: 1 server(s)
262
+ - GPIO/hardware boundary: 1 server(s)
263
+ - GraphQL/Database query boundary: 1 server(s)
264
+ - GST return/invoice/billing boundary: 1 server(s)
265
+ - Health service/disease surveillance boundary: 1 server(s)
266
+ - Home automation boundary: 1 server(s)
267
+ - Hotel reservation boundary: 1 server(s)
268
+ - Identity verification/CNIC boundary: 1 server(s)
269
+ - Identity verification/KYC boundary: 1 server(s)
270
+ - Image generation boundary: 1 server(s)
53
271
  - Infrastructure tool surface: 1 server(s)
272
+ - Insurance claim/beneficiary boundary: 1 server(s)
273
+ - Interbank transaction/switch boundary: 1 server(s)
274
+ - Issue/board/sprint boundary: 1 server(s)
275
+ - Issue/event boundary: 1 server(s)
276
+ - Issue/project boundary: 1 server(s)
277
+ - Job listing/application/candidate boundary: 1 server(s)
278
+ - Key/value mutation boundary: 1 server(s)
279
+ - Learning content boundary: 1 server(s)
280
+ - Legal content retrieval boundary: 1 server(s)
281
+ - Lint result boundary: 1 server(s)
282
+ - Listing/ad/user boundary: 1 server(s)
283
+ - Map/routing/geocode boundary: 1 server(s)
284
+ - Maps/routing/ride boundary: 1 server(s)
285
+ - Market data boundary: 1 server(s)
286
+ - Match/player/statistics boundary: 1 server(s)
287
+ - Merge/CI pipeline boundary: 1 server(s)
288
+ - Message boundary (WhatsApp): 1 server(s)
289
+ - Message/channel boundary: 1 server(s)
290
+ - Message/chat boundary: 1 server(s)
291
+ - Message/session boundary: 1 server(s)
292
+ - Message/template/contact boundary: 1 server(s)
293
+ - MLS data boundary: 1 server(s)
294
+ - Mobile wallet/payment gateway boundary: 1 server(s)
295
+ - Model/inference boundary: 1 server(s)
296
+ - Multi-channel message boundary: 1 server(s)
297
+ - Music library boundary: 1 server(s)
298
+ - Note/vault/file boundary: 1 server(s)
299
+ - Notification/audience boundary: 1 server(s)
300
+ - NSE market data boundary: 1 server(s)
301
+ - Nutrition/ingredient/dietary boundary: 1 server(s)
302
+ - Order/restaurant/delivery boundary: 1 server(s)
303
+ - Page/database boundary: 1 server(s)
304
+ - Page/space boundary: 1 server(s)
305
+ - Paper metadata/search boundary: 1 server(s)
306
+ - Patient data boundary: 1 server(s)
307
+ - Patient record/hospital management boundary: 1 server(s)
308
+ - Patient/claim/hospital boundary: 1 server(s)
309
+ - Payment/refund/settlement boundary: 1 server(s)
310
+ - Payment/wallet/OTC boundary: 1 server(s)
311
+ - Permit/expedition/safety boundary: 1 server(s)
54
312
  - Persistent state tools: 1 server(s)
313
+ - Pipeline/build boundary: 1 server(s)
314
+ - Playback/library boundary: 1 server(s)
315
+ - Playback/playlist boundary: 1 server(s)
316
+ - Product/order boundary: 1 server(s)
317
+ - Product/order/seller boundary: 1 server(s)
55
318
  - Prompt-injection-sensitive retrieval: 1 server(s)
56
319
  - Prompt/resource contract: 1 server(s)
57
320
  - Prompt/tool inventory: 1 server(s)
321
+ - Property listing boundary: 1 server(s)
322
+ - Record/org/metadata boundary: 1 server(s)
323
+ - Resource/provisioning boundary: 1 server(s)
58
324
  - Sandboxed filesystem access: 1 server(s)
325
+ - Search result/LLM boundary: 1 server(s)
326
+ - Server/channel/message boundary: 1 server(s)
327
+ - Shell/exec/file boundary: 1 server(s)
328
+ - SMS/campaign boundary: 1 server(s)
329
+ - SMS/vas/digital boundary: 1 server(s)
330
+ - SMS/voice/chat boundary: 1 server(s)
331
+ - SMS/voice/data boundary: 1 server(s)
332
+ - SMS/voice/fiber boundary: 1 server(s)
333
+ - SMS/voice/network boundary: 1 server(s)
334
+ - Sports content boundary: 1 server(s)
335
+ - Spreadsheet read/write boundary: 1 server(s)
336
+ - SQL query boundary: 1 server(s)
337
+ - SQL query boundary (MySQL): 1 server(s)
338
+ - SQLite file boundary: 1 server(s)
59
339
  - Startup/listing reproducibility: 1 server(s)
340
+ - Store/product/order boundary: 1 server(s)
341
+ - Story/epic/workflow boundary: 1 server(s)
342
+ - Student/enrollment/grade boundary: 1 server(s)
343
+ - Table/item mutation boundary: 1 server(s)
344
+ - Task list mutation boundary: 1 server(s)
345
+ - Task/list/doc/chat boundary: 1 server(s)
346
+ - Tax return/NTN/invoice boundary: 1 server(s)
60
347
  - Temporary directory filesystem access: 1 server(s)
348
+ - Test case/result boundary: 1 server(s)
349
+ - Test run/report boundary: 1 server(s)
350
+ - Test/API/quality boundary: 1 server(s)
351
+ - Ticket booking/PNR/availability boundary: 1 server(s)
352
+ - Ticket/user/knowledge boundary: 1 server(s)
61
353
  - Tool schema clarity: 1 server(s)
354
+ - Trace/observation data boundary: 1 server(s)
355
+ - Tracking/delivery/geocode boundary: 1 server(s)
356
+ - Trade execution boundary: 1 server(s)
357
+ - UPI transaction/bank boundary: 1 server(s)
358
+ - Vehicle/listing/dealer boundary: 1 server(s)
359
+ - Video content boundary: 1 server(s)
360
+ - Video management boundary: 1 server(s)
361
+ - Vulnerability/finding boundary: 1 server(s)
362
+ - Wallet/payment gateway boundary: 1 server(s)
363
+ - Weather data boundary: 1 server(s)
364
+ - Weather forecast boundary: 1 server(s)
365
+ - Weather/forecast/disaster boundary: 1 server(s)
366
+ - Web content ingestion boundary: 1 server(s)
367
+ - Web fetch boundary: 1 server(s)
368
+ - Web search/reader boundary: 1 server(s)
369
+ - Web search/result boundary: 1 server(s)
370
+ - Work item/repo/pipeline boundary: 1 server(s)
62
371
  - Write/merge tool boundary: 1 server(s)
63
372
 
64
373
  ## Publication Rules