Check M2 · provenance family · severity HIGH · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM03 ATLAS AML.T0074 A namespace verified to one owner that declares another owner's repository: a listing that may borrow a reputation it does not hold.
The question this check asks: who did the registry verify published this server, and does the repository the listing points at belong to them?
The registry verifies a namespace before it accepts a listing under it: io.github.<owner> through a sign-in to that GitHub account, and a reverse-DNS namespace such as com.example through DNS for example.com. What it does not check is that the repository a listing declares belongs to the verified owner. A listing under io.github.alice can name bigvendor/official-server as its source and borrow that repository's stars and history.
Under io.github.<owner>, a declared GitHub repository of another owner is mcpr-namespace-mismatch: HIGH and 10 points on a listing first published under 90 days ago, MEDIUM and 4 points on an older one. A declared repository outside GitHub is the same finding, because a GitHub sign-in says nothing about who controls a gitlab.com project of the same name. When the owners match, or the namespace is verified by DNS, the result is a note naming who the registry verified. A warning under the default profile, never a block on its own.
A company that publishes under its own GitHub account but keeps the code in an organisation of a different name fires this check. The finding names both owners, so the reader can see whether they are plainly the same company.
Who controls a DNS namespace beyond the registry's own verification. The reputation of the owner: that is M3's question, through the 22 checks on the declared repository. A lookalike namespace: the registry publishes no popularity data, so there is no list of known names to compare against.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '.server.name, .server.repository.url'What does the registry verify about a namespace? For io.github.<owner>, that the publisher signed in to that GitHub account; for a reverse-DNS namespace, a DNS record on the domain. It does not check that the repository a listing declares belongs to that owner.
Why is a mismatch only medium on an older listing? Because an established listing has had time to be noticed, and the common honest case is a company publishing from one account with code in another. On a new listing the same shape is graded high.
Is there a lookalike-name check? No. The registry carries no download or star count, so there is nothing to call a name well known; a lookalike check would have nothing to anchor on.
M3 Source repository · M9 Listing age · P4 Name matches its source.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.