How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption. Grade C reflects the trust score band: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Full methodology →
Signals refreshed2026-06-22 00:01 UTC·Repo last pushed 3 days ago
Rank Trend
2026-06-202026-06-21
Activity & Reach
Stars
10.1k
Forks
1.3k
Last Push
2026-06-19
3 days ago
Commits (4 wk)
35
Downloads (7d)
—
HN mentions (30d)
—
Open Issues
91
Rank Change
=
was #127
Analysis
HVTrust Dimensions
63.5 / 100 · 100.0% confidence
Safety / IntegrityOSSF, provenance, signatures
11.5 / 25
Identity / ProvenanceListing and build link
10.8 / 18
TransparencyLicense and public checks
13.6 / 17
MaintenanceFreshness and commits
18.0 / 20
AdoptionStars and downloads
9.6 / 20
Activity Inputs
82.8 / 100
StarsRepository reach
24.0 / 30
FreshnessLast push recency
24.6 / 25
ActivityRecent commits
19.4 / 25
CommunityFork signal
14.5 / 20
Supply Chain Trust
Package Provenance
None
No package attestations found
OSSF Scorecard
6.0 / 10
OpenSSF Scorecard · scanned Jun 21, 2026
Signed Commits
79%
of last 100 commits verified
Binary-Artifacts10
Branch-Protection5
CI-Tests10
CII-Best-Practices0
Code-Review1
Contributors10
Dangerous-Workflow10
Dependency-Update-Tool10
Fuzzing0
License10
Maintained10
Packaging10
Pinned-Dependencies0
SAST8
Security-Policy10
Signed-Releases-1
Token-Permissions0
Vulnerabilities0
Is mcp-use safe?
mcp-use has a mixed signal profile. Some trust indicators are present, others are missing. Whether it is safe for your use case depends on which gaps matter to you — review the breakdown below before adopting in production.
Does mcp-use publish package provenance?
No published build provenance is currently detected for mcp-use. This is common for open-source projects but means consumers cannot independently verify that the package on the registry matches the GitHub source.
Does mcp-use have an OpenSSF Scorecard?
mcp-use has an OpenSSF Scorecard score of 6.0/10. The Scorecard checks for branch protection, signed releases, dependency updates, fuzzing, code review, and other supply-chain hygiene items. See the full check breakdown on this page.
Is mcp-use actively maintained?
Actively maintained. The repository was pushed to within the last 3 day(s).
What license does mcp-use use?
mcp-use ships under MIT. A declared, OSI-approved license is one of the transparency signals HVTrust scores.
Are mcp-use's commits signed?
79% of the last 100 commits to mcp-use are verified-signed (GPG, SSH, S/MIME, or GitHub's signing flow). Signed commits help confirm that code was authored by who the commit claims.
Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.
AI agent surface
Profile context only
HVTrust currently ranks supply-chain and project-integrity trust only. This public view shows a compact AI-agent surface snapshot from repo docs and manifests. These fields are descriptive context and do not affect the production HVTrust rank. An experimental local preview remains available in Score Lab →, and the policy boundary is tracked on the roadmap →
MCP Server Support
high confidence
Implemented
mcp-use appears to expose MCP server capabilities.
Detailed evidence is not shown in the public view.
External Service Dependencies
high confidence
6 detected
Public provider/service dependencies detected.
Anthropic
E2B
OpenAI
Postgres
Redis
Supabase
Credential signal:
No explicit API-key/config marker detected.
Tool / Plugin Surface
high confidence
Declared
Declared plugin/integration surface detected.
code
database
filesystem
search
Detailed evidence is not shown in the public view.
Package Provenance Drift
N/A
No package source configured
Detailed evidence is not shown in the public view.
MCP signal live
External deps live
Tool / plugin surface live
Package provenance drift live
Maintain mcp-use?
HVTrust scores mcp-use from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.
Data sources
GitHub REST API (repo, commits, stars, forks, license) · OpenSSF Scorecard CLI
Each agent's signals refresh once daily across 6 staggered batches. Methodology v3.2 · Raw JSON
