The MCP SDK Looks Safe. Its Supply Chain Has 11 CRITICAL Single-Maintainer Packages. Scorecard: April 13, 2026 The Model Context Protocol is becoming the standard plumbing for AI tools. Claude, Cursor, Windsurf, and a growing list of AI assistants connect to MCP servers to browse the web, read files, query databases, and execute code. If you're building an AI product in 2026, you're probably using @modelcontextprotocol/sdk . Here's what the package itself looks like when scored by behavioral commitment: @modelcontextprotocol/sdk — score: 75/100 | 6 maintainers | 31M downloads/week | 1.4 years old Enter fullscreen mode Exit fullscreen mode Six maintainers. Respectable. Score of 75. No CRITICAL flag. You might stop there. Don't stop there.…