Two I would add under "Is it alive?". First, check whether the package itself is deprecated on npm, not just the repo: npm view PACKAGE deprecated. Repos get archived quietly while the package keeps getting installed. The 12 deprecated servers under @modelcontextprotocol were still downloaded about 620,000 times in the week of Oct 27 to Nov 2. Second, pin the version in .mcp.json instead of running npx with no version, so the code you vetted is the code that runs next week.