Check M1 · provenance family · severity HIGH · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM03 What the registry itself says about the listing. A deprecated or withdrawn server is a state of the listing, not a technique.
The question this check asks: does the registry itself still list this server as active? The registry keeps a status on every listing, and a publisher can mark a server deprecated with a message saying why.
A deprecated listing is one its own publisher has stepped back from: superseded by another name, moved, or no longer maintained. A server configured from it keeps running whatever was last published, and an unmaintained server is where an unpatched dependency or an abandoned package name ends up. The registry's own word is the cheapest signal there is, and RepoGates reads it before anything else.
The status is _meta's official status in the server's latest record. mcpr-deprecated is MEDIUM and 4 points, with the publisher's status message printed beside it (printable text, shortened). Any status other than active or deprecated is mcpr-status:<status>, HIGH and 10 points. Both are warnings under the default profile, never a block on their own. A name the registry answers 404 for is not assessable: the verdict is “not assessed”, never a pass, and no check runs.
A server deprecated in favour of a new name under the same publisher is a REVIEW until you move to the new name. The finding prints the publisher's message, which usually names the replacement.
Why a publisher deprecated a listing beyond the message it wrote. Whether the server still answers: a remote endpoint is not contacted. Older versions: only the latest record is read for status.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '.server.name, ._meta["io.modelcontextprotocol.registry/official"].status'Is a deprecated server blocked? No. Deprecation is the publisher's word that the listing is no longer the one to use; it is a medium finding that makes the verdict REVIEW, and the publisher's message is shown so you can find the replacement.
What happens when the registry no longer has the server? The verdict is not assessed, never a pass. A name that has been removed can be registered again by someone else, so nothing is inferred from its absence.
Does RepoGates contact the server to see whether it still works? No. M1 reads the registry's record only; a remote endpoint is never contacted and a package is never run.
M9 Listing age · M2 Namespace · P11 Deprecated or yanked.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.