@azure/mcp (npm MCP)

Approved Version Pin: 4.0.0-beta.7 · Source: npm Registry · Checked: 2026-11-13

NO-GO · BLOCKED

Install Hooks (CC6.6)

FAIL (Hook Detected)

SLSA Provenance

Not attested

Maintainers / Deps

3 owners · 6 deps

Deprecated Status

Active

        Tarball SHA-512 Digest: sha512-0bvsAd6giuwRIY7Mu9t7touhSy+3S6N5x/WUEX9FDYNW8EYoVmKtK1H4+t8ty9xBwkGyeCTElm/XiQ2dPWvbBQ==
      

Forensic Evidence Findings

Early or pre-release version (4.0.0-beta.7)
Tarball SHA-512 verified (sha512-0bvsAd6giuwRIY7...)
Executes install lifecycle script (postinstall: node ./scripts/post-install-script.js)
Zero insecure flags in npm registry telemetry

2026-11-13 [WASH_RISK_SPIKE]: Wash/sybil risk jumped from 5% to 65% in latest ledger scan. (4.0.0-beta.7 → 4.0.0-beta.7)
2026-11-12 [LIFECYCLE_INSTALL_HOOK]: Active release @azure/mcp@4.0.0-beta.7 runs install script (postinstall: node ./scripts/post-install-script.js). Blocked from silent auto-approve. (4.0.0-beta.7 → 4.0.0-beta.7)
2026-11-12 [VERSION_RELEASE_DRIFT]: Release version advanced from 4.0.0-beta.6 to 4.0.0-beta.7; re-pin local configs after review. (4.0.0-beta.6 → 4.0.0-beta.7)
2026-11-06 [LIFECYCLE_INSTALL_HOOK]: Active npm release @azure/mcp@4.0.0-beta.6 executes lifecycle shell script (postinstall: "node ./scripts/post-install-script.js") during install. (4.0.0-beta.5 → 4.0.0-beta.6)

IT / Security Reviewer: ___________________________
Review Date: _______________

Continuous Drift Protection
Auto-block silent postinstall pushes in GitHub PRs.
Unlock $149 SOC 2 Pack or $299/mo Team Gate →