Evaluation report
Warnings@butterbase/control-api · mcp5bbee97· 3 months ago
Every check MetaHub ran on this artifact, grouped by area. Static checks run on the source at publish time; behavioral checks run the artifact in a sandbox and judge what it actually does.
Structural
5 passedRepository is reachable
https://github.com/butterbase-ai/butterbase @ 5bbee97 — ★ 2,529 · TypeScript · Apache-2.0 · last push today
Manifest detected
kind=mcp slug=butterbase-control-api · path=services/control-api · source=package.json
Slug is URL-safe
"butterbase-control-api" matches /^[a-z0-9][a-z0-9-]{0,62}$/
Slug is unique within kind
No collision found for mcp/butterbase-control-api
Version is semver
0.1.0
Documentation
4 passed1 warningDescription qualitywarn
Only 3 words · 34 chars — more detail helps discovery
Tell consumers what this artifact does in a full sentence.
README is present and substantial
14,680 chars · 14 sections · 10 code blocks
Tags / topics declared
7 total — baas, backend-as-a-service, mcp, open-source, postgres, supabase-alternative (+1)
README has usage / example sections
found: Quickstart
Homepage / docs URL declared
no homepage declared (registry will use the repo URL) — info-only, not blocking
Safety
2 passed1 warningDependencies: known vulnerabilitieswarn
3 high/critical advisories — @modelcontextprotocol/[email protected] (HIGH: GHSA-345p-7cg4-v4c7) · @modelcontextprotocol/[email protected] (HIGH: GHSA-8r9q-7v3j-jr4g) (+1)
Update the affected packages, then re-publish. (`npm audit` shows the same data locally.)
LICENSE file at repo root
LICENSE
No sensitive files in the repo
scanned for .env, credentials.json, *.pem, .ssh/, AWS / GCP configs — none found
Kind-specific
5 passedMCP: launch path
scripts.start
MCP: @modelcontextprotocol/sdk in dependencies
pinned at "^1.12.0"
MCP: SDK version pinned
pinned at "^1.12.0"
MCP: ESM package
"type": "module"
MCP: server surface
0 tools
Maintenance
2 passed1 warningCI configuration detectedwarn
no CI config found (looked for GitHub Actions, CircleCI, GitLab CI, etc.)
Add a simple workflow (lint + test on PR) — it tells consumers the artifact is built reproducibly.
Recent activity
last push today
Tests detected
11 test directories · 369 test files
Behavioral
This artifact hasn't produced behavioral results yet: the evaluation sandbox couldn't run it (it may need credentials we don't provide, or a build our environment doesn't support). That's a limitation of our environment, not a verdict on the artifact.