AgentArmorHQ
Sign in

Check before you install

Thinking of installing an AI tool? Paste its name or link. We'll tell you if it has been reported as malware or looks risky. Free, no sign-up.

Looks like a package.

package typescript-sdk

No known issues

Grade A (Few risk signals). Use --ignore-scripts and pin exact version.

Latest version
2.4.0
First published
7 months ago
Maintainers
6
Catalog grade
A — Few risk signals
Est. context load
~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)

Threat reports

  • ReportedMCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
  • ReportedMCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
  • ReportedMCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
  • ReportedMCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

Install it pinned and without install scripts:

npm install --ignore-scripts --save-exact "@modelcontextprotocol/server"

Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee. Answers change through the day.

Was this check for typescript-sdk helpful?
Free first look / $19 full report

Go deeper

The answer above comes from threat reports and registry facts. A free first look also analyzes this version’s published files and shows the grade and how many serious issues we found. The full report adds the evidence, what it can access and what it does at install: $19 once, or 3 a month on Pro.

See a sample full report

Want to look around first? Browse the MCP & Skills directory or read the guides.