Is `@modelcontextprotocol/server-everything` safe?

verified, no known advisories Facts from the mcp-audit registry about the npm package @modelcontextprotocol/server-everything. The same data is served as JSON.

Check it from your terminal

mcp-audit vet @modelcontextprotocol/server-everything

Offline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.

Registry facts

Maintainer	Anthropic
Verified publisher	yes
Entry last checked	2026-08-22
Hash pins	none recorded
Provenance expected	yes; a missing Sigstore attestation is reported (`ATTEST-013`) with `--verify-signatures`
Repository	https://github.com/modelcontextprotocol/servers

Recorded advisories 0

No advisories are recorded for this package.

What it can do

It can read files on your machine.
It can write or modify files on your machine.
It can make outbound network requests.
It can execute shell commands.

Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.

Check how you run it

This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.

mcp-audit check

Badge for your README

mcp-auditverified · 0 known CVEs

Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.

[![mcp-audit](https://img.shields.io/endpoint?url=https://mcp-audit.dev/v1/badge/npm/at-modelcontextprotocol-server-everything.json)](https://mcp-audit.dev/servers/npm/at-modelcontextprotocol-server-everything/)

Is @modelcontextprotocol/server-everything safe?