Vitality Report-2026-02-25

[yamyr]

🏥 Repository Vitality Report — 2026-02-25

Repository: ajentik/mcp_server
Language: Ruby
Created: 2025-07-03
License: MIT
Assessment Date: 2026-02-25

---

📊 Activity Summary (Last 12 Months)

Metric	Value
Commits	22
Pull Requests	10
Issues	0
Contributors	1 (Ezra)
Last Commit	2025-07-07
Days Since Last Commit	~233 days

Activity Level: 🟡 Stalled but Strategic — Active development for ~5 days (July 3-7, 2025) with a healthy PR workflow (10 PRs for 22 commits = good review culture). But completely dormant for 7+ months.

---

🔒 Security & Dependency Audit

Open Dependabot Alerts: 8

Severity	Count	Key Vulnerabilities
🟠 High	6	Rack directory traversal, memory exhaustion DoS, multipart DoS (3 separate), query parser bypass
🟡 Medium	2	Rack XSS via Directory, information disclosure

Dependency Analysis (Gemfile)

• mcp gem (from github.com/modelcontextprotocol/ruby-sdk, main branch) — Pinned to main branch ⚠️
• Uses gemspec — library-style packaging ✅

Critical Concern: ALL 8 vulnerabilities are in Rack, which is the HTTP middleware layer. Since this is an MCP server that handles HTTP requests, these vulnerabilities directly affect its attack surface.

Double Concern: core repository depends on this repo via gem "mcp_server", git: "https://github.com/ajentik/mcp_server.git" — so core's security is transitively affected.

---

🔧 Technology Obsolescence Check

Technology	Status
Ruby	✅ Current
MCP (Model Context Protocol)	✅ Cutting-edge — MCP is a 2024-2025 standard for AI tool use
Rack	✅ Current (needs security patches)
mcp gem (ruby-sdk)	⚠️ Pinned to main branch — unstable dependency

MCP is highly strategic. The Model Context Protocol is the emerging standard for AI agent tool integration. This repo implements an MCP server in Ruby — relevant and forward-looking technology.

---

📈 Vitality Score Calculation

Factor	Weight	Score	Weighted
Commit frequency (12mo)	25%	25/100	6.25
PR/Issue activity	15%	40/100	6.0
Contributor diversity	10%	10/100	1.0
Security posture	20%	20/100	4.0
Tech currency	15%	85/100	12.75
Recency of activity	15%	15/100	2.25

Vitality Score: 32/100 🟡

---

🎯 Recommendation: KEEP (with conditions)

Rationale for Keeping Despite Low Score

1. Strategic dependency — core depends on this repo directly; archiving would break the main product
2. MCP is cutting-edge — Model Context Protocol is the future of AI tool integration
3. MIT Licensed — open-source, good practice for a library
4. Good PR hygiene when it was active — suggests quality code
5. Small, focused library (48KB) — not a maintenance burden

Why Not Higher Score

• 7+ months dormant
• 8 Rack vulnerabilities unpatched
• Single contributor (bus factor = 1)
• Depends on main branch of upstream MCP ruby-sdk (unstable)

Required Actions:

1. Urgent: Update Rack to patch all 8 vulnerabilities — this transitively affects core
2. Important: Pin mcp gem to a tagged release instead of main branch
3. Recommended: Add a second maintainer to reduce bus factor
4. Recommended: Set up CI/CD with automated security scanning

---

Generated by Repo Vitality Assessment — 2026-02-25