mcp-scan / check
mcp-scan / check
npm package 'report' has not been updated in over 6 months.
Package 'report' has no license specified.
Package 'report' has a low supply chain trust score (0/100).
Server 'report' is an unscoped package from an unverified source (higher typosquatting risk).
Name-based heuristic, not evidence of a problem. Publishers can clear it with npm provenance.
A clean scan is static analysis of the published package, not a security guarantee.