
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
mcp-doctor
Advanced tools
Check and improve the contract quality of any MCP server — for humans, agents, and platforms.
Check and improve the contract quality of any MCP server — for humans, agents, and platforms.
Most MCP servers are built with only one audience in mind (usually human developers reading a README). But a successful MCP server needs to satisfy three audiences simultaneously:
MCP Doctor checks all six dimensions of "contract quality" and gives you actionable recommendations.
pip install mcp-doctor
mcp-doctor check /path/to/your-mcp-server
| Dimension | Question |
|---|---|
| Task Clarity | Is the server's purpose immediately clear? |
| Trust & Safety | Are side effects, permissions, and safety boundaries declared? |
| Interface Quality | Are tools well-named, well-described, and well-typed? |
| Token Efficiency | Will tool responses fit an agent's context budget? |
| Install Friction | How fast can someone go from discovery to first use? |
| Cross-platform Readiness | Is metadata complete for Registry, Smithery, PulseMCP, Glama? |
# Terminal output (default)
mcp-doctor check /path/to/server
# JSON output (for CI/CD)
mcp-doctor check /path/to/server --format json
# Markdown output (for README badges or reports)
mcp-doctor check /path/to/server --format markdown
MCP Doctor is also an MCP server, so AI agents can use it to check other servers:
{
"mcpServers": {
"mcp-doctor": {
"command": "python",
"args": ["-m", "mcp_doctor.mcp_server"]
}
}
}
Tools:
check_server(path, format) — Run all 6 checks on a server at the given pathlist_dimensions() — List what MCP Doctor evaluatesEach dimension is scored 0-100 and graded A/B/C/D:
MCP Doctor is based on the Contract Quality Framework — the principle that a successful MCP product's promises (what it does, what it costs, what risks it carries) should be equally parseable by platforms, humans, and agents.
The framework draws from:
MIT
FAQs
Check and improve the contract quality of any MCP server — for humans, agents, and platforms.
The pypi package mcp-doctor receives a total of 240 weekly downloads. As such, mcp-doctor popularity was classified as not popular.
We found that mcp-doctor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.