reference-mcp server

by AbduljabbarBXR·io.github.AbduljabbarBXR/reference-mcp·v0.1.6

Reference integrity for AI agents. Scans and verifies links, imports, assets, deps.

D46/100grade D

What users say

No reviews yet

Safety scan

D46/100

Adoption

New

51 downloads/wk

Reviews

Nobody has reviewed reference-mcp yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

reference.check
Verify the references in a repository. Local paths are checked against the filesystem, module names against the npm registry, and URLs over HTTP. Returns findings with a status per reference.
reference.scan
Scan a repository and extract every reference: URLs, local imports, assets, and module dependencies. Returns a deduplicated list by kind.

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

1 high1 low

Code scan2 source files scanned13/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenanceno repository listed3/15
Maintainer identityno repository or website to verify2/10

highShell command built from a string (injection risk)exec.shell-concat

src/index.js: …lse { try { const match = execSync(`find "${root}" -type f -name "${basenameName(value)}" 2>/dev/null | head…

Overall 46/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 46/100; higher than 8% of 48,255 servers
Tools: 2; the typical server has 7
Tools that change things: 0%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 51; more than 43% of 12,191 servers with a package

What its tools let an agent do: 2 read

Release history: 2 versions in the registry since 2026-09-16, latest 2026-09-17, typically one every 1 day.

Runs npx -y reference-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add reference-mcp -- npx -y reference-mcp

2026-09-19downgradeC → Dscore 46: Shell command built from a string (injection risk); No source repository listed

Is reference-mcp server safe?: Not recommended: it is graded D (46/100). Read the reference-mcp safety report
How do I install reference-mcp?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does reference-mcp need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is reference-mcp maintained?: The latest release is v0.1.6.
How does reference-mcp compare with other MCP servers?: safety score 46/100 (higher than 8% of 48,255 servers); tools 2 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.