The MCP SDK Looks Safe. Its Supply Chain Has 11 CRITICAL Single-Maintainer Packages.

Scorecard: April 13, 2026

The Model Context Protocol is becoming the standard plumbing for AI tools. Claude, Cursor, Windsurf, and a growing list of AI assistants connect to MCP servers to browse the web, read files, query databases, and execute code. If you're building an AI product in 2026, you're probably using @modelcontextprotocol/sdk .

Here's what the package itself looks like when scored by behavioral commitment:

@modelcontextprotocol/sdk — score: 75/100 | 6 maintainers | 31M downloads/week | 1.4 years old

Enter fullscreen mode

Exit fullscreen mode

Six maintainers. Respectable. Score of 75. No CRITICAL flag.…