# Before you add an MCP server: live KarmaDue checks, explained

Captured 2026-11-10 between 9:06 and 9:08 AM America/New_York (14:06 to 14:08 UTC) from KarmaDue's public endpoints, with no account and no key. Answers change as advisories, registries, versions and release ages change, so rerun the call before you act rather than trusting this page as current.

Published by KarmaDue (karmadue.expo.app). These are KarmaDue's own outputs, not an independent review.

## When to call

Adding an MCP server usually means one of two things: a new entry in `.mcp.json`, `.cursor/mcp.json` or `claude_desktop_config.json` whose `command` is `npx -y <package>`, or a repository you clone and start. Either way, code from the registry runs on your machine with whatever the server is allowed to touch. Check the exact package (and version, if you will pin one) before you write the config or start the process.

## Two calls

Safety MCP `check` (one decision for one target and one action):

    curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \
      -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"npm:mcp-remote@0.1.15","action":"run with npx as an MCP server"}}}'

Read `result.structuredContent.data`: act on `enforce`, use `decision` for the reason category, show `headline` to your person, and read `gaps` for what was not checked. `target` accepts `npm:name@version`, `pypi:name==version`, a GitHub URL or a KarmaDue id. `action` is free text; KarmaDue maps it to an `action_class` (`install`, `execute`, `destructive`, and others), shown in `scope`.

Default MCP `check_install` (the same safety feeds, plus tested setup recipes where they exist):

    curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp \
      -H 'content-type: application/json' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_install","arguments":{"target":"@modelcontextprotocol/server-filesystem","ecosystem":"mcp","runtime_env":"node 20 linux"}}}'

Read `result.content[0].text` (JSON). `enforce` here is `block`, `ask` or `care`; `fix` and `do_not` appear when a recipe exists. Add `"detail":"full"` for the records behind a recipe.

## The answers (safety `check`)

| Target | action (as sent) | action_class | decision | enforce | Why (headline, shortened) |
|---|---|---|---|---|---|
| `npm:postmark-mcp@1.0.18` | run with npx as an MCP server | execute | `deny` | `block` | Malicious-package report MAL-2025-47604: turned malicious in v1.0.16, exfiltrates email via BCC. |
| `npm:mcp-remote@0.1.15` | install | install | `warn` | `require_human_approval` | 1 published advisory (GHSA-6xpm-ggf7-wc3p / CVE-2025-6514) affects 0.1.15; `fixed_in` 0.1.16. |
| `npm:mcp-remote` (unpinned) | install, and run with npx as an MCP server | install / execute | `warn` | `proceed_with_care` | Resolved to 0.16.5, published 2026-11-07, 3 days earlier (under 7 days). |
| `npm:@modelcontextprotocol/server-filesystem` (unpinned) | install, and run with npx as an MCP server | install / execute | `warn` | `proceed_with_care` | Resolved to 2.2.0, published 2026-11-04, 5 days earlier (under 7 days). |
| `npm:@modelcontextprotocol/server-filesystem@1.0.0` | run with npx as an MCP server | execute | `no_known_issues` | `proceed_with_care` | No advisories or malicious reports; 1,364,989 downloads last week; named publisher. |
| `npm:@modelcontextprotocol/server-github` (unpinned) | run with npx as an MCP server | execute | `warn` | `proceed_with_care` | Resolved to 2025.4.8; publisher deprecated it ("Archived and unmaintained; no security guarantees"); upstream repository archived. |
| `npm:@modelcontextprotocol/server-filesystm` (one letter off) | run with npx as an MCP server | execute | `unverified_existence` | `require_human_approval` | The npm registry has no package with that name; anyone could register it later. |
| `https://github.com/ActiveCampaign/postmark-mcp` | add as an MCP server | install | `unknown` | `proceed_with_care` | "Not assessed": KarmaDue has facts about the project, not a safety verdict. |
| `npm:@modelcontextprotocol/server-filesystem` | delete files in the project folder | destructive | `require_human_approval` | `require_human_approval` | Destructive: cannot be undone, so it needs your person's approval whatever the record says. |

## What each answer means for your config

1. **Malicious report: do not write the entry.** `postmark-mcp@1.0.18` is `deny` / `block` for both install and run. The answer's `scope.checked` also says npm no longer publishes that version, which does not make an old cached copy or a lockfile reference safe. The `alternatives` are labeled "similar ... Not checked as a drop-in replacement"; `check_install` for the same target returned a founder-operated recipe pointing to the scoped `@activecampaign/postmark-mcp`. Check any replacement separately before you use it.
2. **An advisory on the pinned version: ask, or move to the fixed version and check again.** `mcp-remote@0.1.15` is covered by CVE-2025-6514. The answer gives `fixed_in: 0.1.16` and lists `npm:mcp-remote@0.1.16` as a `fixed_version` alternative. A pin you copied from an old README is exactly where this shows up.
3. **Unpinned `npx -y` resolves to whatever is newest, and newest can be days old.** Both `mcp-remote` and `server-filesystem` resolved to releases under 7 days old, so both got `warn` for release age alone, with no advisory involved. KarmaDue's suggestion is to pin a version you know works or wait a few days. The same package moves out of this caution as the release ages, so a different answer next week is expected, not a contradiction.
4. **Pinning changes the answer.** `server-filesystem@1.0.0` (published 2026-10-11) returned `no_known_issues`. That still came with `proceed_with_care` and gaps: no safety-grade check on file, and runtime behaviour never observed.
5. **Deprecated and archived is a warning, not a block.** `@modelcontextprotocol/server-github` still installs, but the publisher marks it unmaintained. The answer lists `declared_successor` alternatives (`github/github-mcp-server`, and `modelcontextprotocol/servers` from the archived repository's README). For `github/github-mcp-server` the answer says it was named in the publisher's deprecation message, but the deprecation texts quoted in the same answer do not contain that name, so confirm the successor yourself.
6. **A name the registry cannot find is a stop.** A one-letter typo of the filesystem server returned `unverified_existence` with `require_human_approval`. KarmaDue says this is not a malware finding; it is a name nobody owns yet. Fix the name rather than retrying.
7. **A GitHub URL with no mapped package gets `unknown`.** For `ActiveCampaign/postmark-mcp` the gaps say no package is mapped to the repository, so no advisory feed was read. `unknown` with `proceed_with_care` means nothing was assessed, not that it passed. If you will run it from npm, check the npm package name you will actually run.
8. **The action matters as much as the target.** The same filesystem server went from `warn` / `proceed_with_care` (install or run) to `require_human_approval` when the action was "delete files in the project folder". Payment, send, delete and credential actions always need your person's approval.

## The same targets through `check_install`

| Target (ecosystem) | v | enforce | Notes from the answer |
|---|---|---|---|
| `postmark-mcp@1.0.18` (npm) | `deny` | `block` | `safety.verdict` `malicious`; `fix` names `@activecampaign/postmark-mcp`; source labeled founder-operated, not independent. |
| `mcp-remote@0.1.15` (npm) | `warn` | `ask` | `safety.verdict` `advisories`, `fixed_in` 0.1.16. |
| `@modelcontextprotocol/server-filesystem` (mcp) | `warn` | `care` | Fresh-release warning for 2.2.0, plus a recipe: `npx -y @modelcontextprotocol/server-filesystem@1.0.0 $WORKDIR/allowed`. |
| `@modelcontextprotocol/server-github` (mcp) | `warn` | `care` | Deprecation; no tested record. |
| `@modelcontextprotocol/server-filesystm` (mcp) | `unverified_existence` | `ask` | `safety.verdict` `package_not_found`. |

Two things to notice in the filesystem answer:

- The `why` describes 2.2.0, but the `fix` launches 1.0.0, the version the recipe was tested on. With `"detail":"full"` the recipe shows two records at 1.0.0 (kd-seed-003 `PASS`, kd-seed-043 `passed_scoped_tests`), both labeled "Same-owner (founder-operated) assessment, not independent", and "started in 3 of 3 KarmaDue reference environments". The recipe proves the server started and answered `initialize` and `tools/list`; it is not a security review, and it says nothing about 2.2.0.
- In the compact answer the recipe's `source` line carried no founder-operated label; it appeared only with `"detail":"full"`. Treat any recipe as founder-operated unless an answer says otherwise.

## Checking config files in CI

Neither MCP tool takes a whole `.mcp.json` as input; you check one target at a time. For pull requests, the GitHub Action [ashadow07/karmadue-action](https://github.com/ashadow07/karmadue-action) reads `.mcp.json`, `.cursor/mcp.json` and `.vscode/mcp.json` alongside package manifests and lockfiles, and fails on a malicious-code report. Details: https://karmadue.expo.app/docs/feeds.md#github-action. The batch-endpoint caveat on https://karmadue.expo.app/docs/worked-examples.md applies: some older malicious-code incidents appear under `vulnerabilities` rather than `malicious`.

## Limits of these checks

- Evidence comes from the npm and PyPI registries, OSV.dev advisories and OpenSSF malicious-package reports, plus KarmaDue's catalog and recipes where they exist.
- Runtime behaviour is never observed. Nothing here tells you what tools a server exposes, what files or network it reaches, or what it does with its permissions; scope those in your client config (for example, the directories you pass to a filesystem server).
- Releases under 7 days old get a caution by design, so answers for unpinned targets change as releases age.
- `unknown`, `unverified_existence` and a missing record are not clearance.
- Recipes and seed records on this site are founder-operated assessments, not independent verification.
- These answers cover the target you name, not its transitive dependencies.

## Next steps

- More live answers (deny, warn, not found, payment, clean) and the CI batch endpoint: https://karmadue.expo.app/docs/worked-examples.md
- Connect over MCP: https://karmadue.expo.app/docs/mcp.md
- Check automatically on `npx`, `npm`, `pip` and `uv`, or with a Claude Code hook: https://karmadue.expo.app/docs/any-agent.md
- Changes after you install, and the GitHub Action: https://karmadue.expo.app/docs/feeds.md