Check M4 · execution surface family · severity CRITICAL · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM03 ATLAS AML.T0011.001 ATLAS AML.T0010.005 The package an agent's client downloads and runs to start the server: an agent tool delivered as a package.
The question this check asks: what will your MCP client download and run to start this server, and what does RepoGates say about it?
A local MCP server is a package: the client runs npx, uvx, docker run or a bundle the listing names, on your machine, with your user's permissions. The listing's words are not what runs; the package is. M4 judges that package with the same 12 checks an npm install of it gets.
Each npm or PyPI package in the listing goes through the 12 package checks, at most the first three. A package that is BLOCK, or listed in a campaign, is mcpr-package:<key>, CRITICAL and 25 points, and the server is BLOCK; the row carries the package's own findings, and when the package is BLOCK because of its own source repository, that repository's findings, so the server takes exactly the action the package gets. A PASS or REVIEW package is a note. A package from any other registry — an OCI image, an MCPB bundle, NuGet — is mcpr-package-unassessed:<type>, MEDIUM and 4 points: not assessed, never a pass. More than three packages is mcpr-package-unassessed:over-cap, MEDIUM. A listing that launches no package is a note.
A vendor that publishes its server as a container image or an MCPB bundle is a REVIEW for that reason alone. That is a statement about what was read, not about the vendor.
The package's code and what it installs after it. Container images and MCPB bundles: neither is pulled or opened. The version that actually runs when the listing names none; that is M6's finding.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '[.server.packages[]? | {registryType, identifier, version}]'Which package registries are assessed? npm and PyPI, through the 12 package checks. An OCI image, an MCPB bundle and any other registry are a medium not-assessed finding, never a pass.
Why only three packages? Each package is a full assessment with its own source repository. A listing with more is a medium finding naming how many were left unread.
Can a server be stricter than its package? No. A BLOCK package carries its own findings into the server's row, so the server gets the action an install of that package would get.
M3 Source repository · M6 Version pinning · P1 Known malicious.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.