Evaluation report

• Repository is reachable

  https://github.com/bromso/metapowers @ 7aee5d1

• Manifest detected

  kind=mcp slug=metapowers-figma-mcp · path=packages/figma-mcp · source=package.json

• Slug is URL-safe

  "metapowers-figma-mcp" matches /^[a-z0-9][a-z0-9-]{0,62}$/

• Slug is unique within kind

  No collision found for mcp/metapowers-figma-mcp

• Version is semver

  0.1.0

• Description qualitywarn

  Only 3 words · 32 chars — more detail helps discovery

  Tell consumers what this artifact does in a full sentence.

• README is present and substantialwarn

  README present but its contents couldn't be read this scan

  Transient fetch issue — re-run the eval to grade the README's substance.

• Tags / topics declaredwarn

  No manifest tags and no GitHub repo topics

  Add tags to the manifest (or GitHub topics on the repo) so the registry's search and category filters surface this artifact.

• Homepage / docs URL declared

  no homepage declared (registry will use the repo URL) — info-only, not blocking

• Dependencies: known vulnerabilitieswarn

  3 high/critical advisories — @modelcontextprotocol/[email protected] (HIGH: GHSA-8r9q-7v3j-jr4g) · @modelcontextprotocol/[email protected] (HIGH: GHSA-w48q-cv73-mx4w) (+1)

  Update the affected packages, then re-publish. (`npm audit` shows the same data locally.)

• LICENSE file at repo root

  LICENSE

• No sensitive files in the repo

  scanned for .env, credentials.json, *.pem, .ssh/, AWS / GCP configs — none found

• Scan incompletewarn

  GitHub returned 502 Detected 13 artifacts before stopping.

  Check the portal server logs for the underlying network error.

• MCP: launch path

  bin: metapowers-figma-mcp · scripts.start

• MCP: @modelcontextprotocol/sdk in dependencies

  pinned at "^1.0.0"

• MCP: SDK version pinned

  pinned at "^1.0.0"

• MCP: ESM package

  "type": "module"

• MCP: server surface

  0 tools

Behavioral results aren't published for this artifact. The publisher sees the full report on their own dashboard.