Trusted community server

What mcp-scan saw

The registry scanner found the resolved package name in TRUSTED_COMMUNITY_SERVERS, a hardcoded set of widely used non-official packages carrying a LAST_UPDATED date. It is the third branch of the chain, after the malicious and official checks and before the unverified-source else.

Why it fires

It marks packages that the mcp-scan maintainers have reviewed as widely used community implementations, so they do not report as unverified-source. It is a curated allowlist, not a live reputation signal, which is why it carries no score and no fix recommendation.

When this is a false positive

• Name-only matching means a fork or an internal package published under a listed name inherits the label without inheriting the review.
• The list has a LAST_UPDATED date, so it reflects the maintainers' view at that point. A package that has since changed hands still matches.
• This label suppresses only the unverified-source finding. Every other scanner still runs, and a listed package with a bad configuration produces the same findings as any other.

How to fix it

1. Read the other findings for this server. The label covers provenance, not configuration.
2. Check the package's publisher and repository yourself if it holds credentials or filesystem reach, since the list is a snapshot.
3. Pin the version in the args array so the reviewed code is the code that runs.
4. No action is required for this finding itself.