AI-agent provenance (M10)

The question this check asks: did an AI chat assistant or an MCP directory lead you to this server? Not whether the server is about AI — whether the route you took to it went through one. Today RepoGates cannot answer that for a registry listing, and this page says so.

Why it matters

M10 is the MCP-registry counterpart of GitHub's C22, which is live: an assistant's recommendation reads as vetting to the person receiving it, and it is not vetting. Island's AgentBaiting research showed the mechanism on GitHub, and nothing about it is specific to GitHub. Only the browser sees the route at navigation time — which tab opened which — and no board on the registry's pages exists to read it.

How RepoGates scores it

M10 does not run for a server today. In the roster its one input is the browser; on the API path that input is never present, so every verdict lists M10 as not checked, with the reason “decided in the browser at navigation time”. It does not withhold PASS. The scoring table's agent-provenance row — CRITICAL at 25 points, a note at 5 — is matched by finding, not by platform, so the weight is defined; how C22 applies it is on its own page.

False positives we know about

None, because nothing runs. That is a different claim from “zero false positives measured”.

What this check does not cover

Everything until a board on registry pages exists. An agent that recommends a server in a chat and configures it for you is seen by the hook only if it adds it with a claude mcp add line.

Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. On a claude mcp add line, a remote address that a listed server declares is judged with that listing's verdict riding along, and is still an ask: anyone may declare any address in a listing, and the server answering there runs on its operator's machine. A listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what the official MCP registry publishes about a server — its record, its version history, the repository and packages it declares, the remote addresses it names — and never the server's code or what it does once it runs. A remote-only server is REVIEW at best, never a pass. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A server the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.

Check it yourself

curl -s "https://registry.modelcontextprotocol.io/v0/servers/NAMESPACE%2FNAME/versions/latest" | jq '.server.name'

Questions

Does M10 run today? No. It needs the browser to watch the route to a registry page, and no board on those pages exists. Every verdict lists it as not checked, never as passed.

Why keep a check that does not run? So the roster says what it cannot see. A skipped check stated as a skip is honest; leaving it out would let the roster imply it had been considered.

Is this the same as C22? It is C22's counterpart. C22 runs on github.com in the browser extension; M10 would need the same on the registry's pages.

Add RepoGates to Chrome Pricing

Sources for this page: the severities and weights from the product's own roster and scoring tables, and the official MCP registry's published record format. See also the MCP servers intelligence page.