Safety rating · all kinds

fastmcp

Score 88/100 — Strong public signals

Automated checks of public signals as of the date shown. Not a security audit, certification or endorsement, and not a statement about the people who maintain the project. Signals can be incomplete or out of date; each check shows its evidence and source so anyone can verify it.

Checks

• License recorded (OSI-approved) — Found (10/10): An OSI-approved license classifier is recorded (License :: OSI Approved :: Apache Software License).
• Known advisories for the latest version (OSV) — Found (15/15): 1 package version(s) checked against OSV; no matching advisories.
• Runtime dependencies constrained (exact or bounded) — Found (9/9): 1 of 1 declared runtime dependencies are pinned exactly; 0 more carry an upper bound.
• Release attestations (PEP 740) — Not found (0/8): No PEP 740 attestation objects are recorded on the latest release files in the PyPI JSON API record.
• Maintainer activity (release recency and cadence) — Found (10/10): Most recent release upload 0 day(s) before the check; 140 release(s) in the prior 365 days.
• Release files (wheel and source distribution) — Found (8/8): The latest release ships 2 file(s): wheel present, source distribution present.
• Latest release not yanked — Found (8/8): No file of the latest release is marked yanked.
• Project URLs recorded — Partly found (6/8): Project URL slots recorded: source, documentation, homepage.
• Metadata completeness (PEP 621 / core metadata) — Found (8/8): Recorded: requires-python present, summary present, long description present, classifiers 10.