ShadowMCP

PUBLISHED / REPOSITORY EVIDENCE

Browse the ShadowMCP evidence catalog.

Each report is generated from selected public repository evidence, tied to a specific scanned commit and published only after the indexability quality gate passes. Reports support review; they do not declare software safe or unsafe.

11 published reportsSource-linkedBounded scansNo safety verdicts

Official and first-party MCP projects

GITHUB

github/github-mcp-server

Evidence report for GitHub's public MCP server repository.

MCP PROJECT

modelcontextprotocol/servers

Evidence report for the Model Context Protocol servers repository.

MCP PROJECT

modelcontextprotocol/inspector

Evidence report for the MCP Inspector repository.

AWS LABS

awslabs/mcp

Evidence report for AWS Labs' MCP repository.

MICROSOFT

microsoft/playwright-mcp

Evidence report for Playwright MCP.

CHROME DEVTOOLS

ChromeDevTools/chrome-devtools-mcp

Evidence report for Chrome DevTools MCP.

Agent and developer tooling

AGENT

NousResearch/hermes-agent

Commit-pinned agent repository evidence report.

DEVELOPER TOOL

anomalyco/opencode

Bounded repository evidence report.

AGENT SKILLS

addyosmani/agent-skills

Bounded agent and MCP-related repository evidence report.

AGENT TOOLING

obra/superpowers

Commit-pinned repository evidence report.

AI TOOLING

affaan-m/ECC

Bounded repository evidence report.

How to read these reports

Commit-pinned: each published page identifies the repository revision that was scanned.
Bounded: the scanner reads selected public evidence rather than cloning and executing target code.
Evidence-first: FOUND means an observation was made; it is not proof of vulnerability or malicious behavior.
Not-found is scoped: absence inside the selected scan does not prove absence elsewhere.
No verdict: reports do not label repositories safe or unsafe.

Run a current repository scan ↗