Several @modelcontextprotocol/server-* packages on npm appear stale (no recent releases, no repo URL in package.json) #4266

Hi MCP maintainers — opening this as a constructive heads-up rather than a complaint. Apologies if there is a better channel for this.

While running a 200-package validation of an open-source MCP supply-chain scanner I built (weiseer/mcp-doctor) against the most-installed MCP-related npm packages, I noticed that several of the official @modelcontextprotocol/server-* packages on npm have not had a release in over a year and do not include a repository URL in their published package.json.

Concrete list (data pulled from the npm registry on 2026-05-30):

Two questions that would help downstream users:

1. Are these packages intentionally archived in favor of new locations (server-archived org? other replacement?) — if so, the most user-friendly action would be npm deprecate with a pointer to the new location, so anyone who runs npm audit or a supply-chain scanner gets clear guidance.

2. If they are still recommended for use, could the published package.json include a repository field? Without it, supply-chain tools cannot do source-to-binary verification, and there is no canonical place for downstream users to file issues.

I am happy to help with whatever the right path is — including opening PRs to whichever repos host the current source, if pointed at them. The 200-package dataset is at api.weiseer.com/dataset/scan_200.json for reference.

Thanks for everything you build.

— wei ([email protected])