MCPTriage

@shopify/dev-mcp MCP server

npm:@shopify/dev-mcp

Caution

Low-impact capabilities worth knowing about before installing.

Why

Contains invisible or obfuscated characters. in README.md
Contains instructions placed where the agent reads them indirectly. in dist/data/mcp-instructions/admin.md
Changes AI rules or configuration files. in dist/data/mcp-instructions/functions.md
Asks the agent to copy an instruction into everything it writes. in dist/data/mcp-instructions/ucp.md

Scanned version: 1.18.0
Scan date: 2026-11-02
Analysis revision: f48103a381866b92
Integrity: sha512 verified sha512-XvmIpe1TW3QHjV5gb+hbi9k8ucQuHd7uQhZ0F3T6Q72QG+fqFgpiaQ2N58TnHYNnuoxB0upTL6NsLYSliwQzvg==
Listed in: npm registry search
Licence: ISC

Automated static analysis by MoorAI's open-source engine. A verdict describes what the package's code can do, not the intent of its authors. Report a mistake →