Check M3 · provenance family · severity CRITICAL · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM03 ATLAS AML.T0010 Where the server's code comes from. A declared repository that is BLOCK or campaign-listed is the compromise ATLAS names; none declared is an evidence gap.
The question this check asks: where does this server's code come from, and what does RepoGates say about that repository?
A listing's repository is where a reader goes to judge a server, and where a package the server launches is built from. RepoGates already judges repositories through the 22 checks; M3 runs them on the one the listing declares, so a server is never read as better than its own source.
A GitHub or gitlab.com repository the listing declares goes through the 22 checks on the same pass. Its verdict rides along under the rule the skill roster uses: a source that is BLOCK, or listed in a campaign, is mcpr-source:<owner/repo>, CRITICAL and 25 points, and the server is BLOCK. The row carries the repository's own findings, so the action is the one a git clone of that repository gets under the same profile — never stricter, never looser. A PASS or REVIEW source is a note with its verdict and score. No repository declared is mcpr-no-source: a note on a listing 90 days old or more, MEDIUM and 4 points on a newer one. A repository on another host is a note, not assessed. If the repository could not be read in time, the scan is partial and M3 is listed as not checked.
A source repository can be BLOCK on provenance alone — its owner's account under 90 days old, the signal the FakeGit campaign left — and then so is every server that declares it. That is a provenance signal, not proof of malice; the finding names the repository's own drivers, and an override records the reason.
That the published package was built from this repository: the registry does not prove it, and M4 judges the package on its own. The repository's code beyond what the 22 checks read; the deep scan reads a whole repository with your yes.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '.server.repository'Why does a BLOCK repository make the server BLOCK? Because the server's code comes from it. The server carries the repository's own findings, so it gets the action a git clone of that repository would get under the same profile, never a stricter one.
What if the listing declares no repository? On a listing at least 90 days old it is a note; on a newer one it is a medium finding, because a new listing with nothing to check it against is an evidence gap.
Is a repository on another host assessed? Only GitHub and gitlab.com are. A repository declared elsewhere is a note saying it was not assessed.
M4 Launched package · C1 Owner account age · S1 Source repository.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.