Check before you install
Hand this a list of MCP servers or agent skills an agent is about to install, and get a per-item verdict grounded in public evidence: the tashan score, whether the project is still maintained, known advisories at the version that would actually be installed today, whether it runs a script at install time, and what it can reach on the machine. Answers with install / caution / do-not-install and the reason for each. Why this exists: an agent deciding what to add to its own toolbox normally has a README written by the person who wants it installed, a star count, and a download number. None of those survive the question "is this maintained, and is it safe to run today?". This recipe answers that from measurements of 12,656 capabilities, and it is deliberate about what it will not claim. A name that has never been measured comes back as unmeasured, never as unsafe, because absence of evidence is not a finding. A clean scan says nothing known is wrong rather than safe: we read public advisories, declared dependencies and install scripts, we do not execute the code or test it for prompt injection. Confirmed malware is refused outright rather than scored. Nobody can pay to change a score, a rank or a listing.
{
"caveat": "A clean result means nothing known is wrong, not that nothing is wrong. Public evidence only: no code was executed and nothing was tested for prompt injection.",
"verdicts": [
{
"name": "tavily-mcp",
"health": "active",
"reason": "Actively maintained, no known advisory at the version you would install today, no install-time script. Can carry third-party text into the model's context, which is inherent to a search tool and worth knowing.",
"verdict": "install",
"advisories": 0,
"measurement": "https://tashan.sh/capability/pkg-tavily-mcp.html",
"tashan_score": 81,
"install_script": false
}
],
"not_measured": []
}