Check M9 · provenance family · severity HIGH · automatic · one of the 10 MCP-server checks
Maps to OWASP LLM03 A new listing is a provenance signal, not a technique: there is no history yet to judge it by.
The question this check asks: how long has this server been listed?
A listing published for one campaign is new. Age proves nothing about a server's intent — every server was new once — which is why it warns and never blocks; but a listing days old has had no time to be looked at by anyone.
The first publication date is the earliest publishedAt in the server's version history. A listing first published less than 30 days ago is mcpr-age: HIGH and 10 points under a reverse-DNS namespace, MEDIUM and 4 points under io.github.<owner>, where the owner's GitHub account is judged separately through the declared repository. The finding prints the number of days. The same 90-day line that M2 and M3 use decides what “established” means. If the version history cannot be read, the scan is partial and M9 is listed as not checked.
Every honest new server. A first listing is a REVIEW for thirty days; the finding states the age so the reader judges a number, and an override records the reason.
The age of the latest version. The age of the publisher: the registry publishes no account record; a GitHub owner's age is read through the declared repository.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '._meta["io.modelcontextprotocol.registry/official"].publishedAt'Why does a new listing warn but never block? Because every server was new once. Age is a reason to look, not evidence of anything; the finding prints the number of days.
Why is the grade lower under io.github? Because the owner's GitHub account is judged on its own through the declared repository, where an account under 90 days old is a finding of its own.
Where does the date come from? From the earliest publishedAt in the server's version history in the registry.
M1 Registry status · M2 Namespace · P6 Package age.
Add RepoGates to Chrome Pricing
Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.