From a53a11d47c61486124d67bbd8b5b1e6c56e74662 Mon Sep 17 00:00:00 2001 From: lsmlhi_25 Date: Thu, 10 Sep 2026 22:34:43 +0800 Subject: [PATCH 1/2] docs: warn about archived reference servers (#4785) Clarify archived packages are unmaintained; update SECURITY.md and examples. --- README.md | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 9c388c80a4..dbd7037119 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,9 @@ These servers aim to demonstrate MCP features and the official SDKs. The following reference servers are now archived and can be found at [servers-archived](https://github.com/modelcontextprotocol/servers-archived). +> [!WARNING] +> Archived servers are **unmaintained** and provide **no security guarantees**. Their npm packages may still install, but they are not supported by this repository. Prefer actively maintained servers from the [MCP Registry](https://registry.modelcontextprotocol.io/) (or the replacements noted below when available). See [SECURITY.md](SECURITY.md) for reporting guidance. + - **[AWS KB Retrieval](https://github.com/modelcontextprotocol/servers-archived/tree/main/src/aws-kb-retrieval-server)** - Retrieval from AWS Knowledge Base using Bedrock Agent Runtime. - **[Brave Search](https://github.com/modelcontextprotocol/servers-archived/tree/main/src/brave-search)** - Web and local search using Brave's Search API. Has been replaced by the [official server](https://github.com/brave/brave-search-mcp-server) ([`@brave/brave-search-mcp-server`](https://www.npmjs.com/package/@brave/brave-search-mcp-server)). - **[EverArt](https://github.com/modelcontextprotocol/servers-archived/tree/main/src/everart)** - AI image generation using various models. @@ -116,16 +119,9 @@ Additional examples of using the Claude Desktop as an MCP client might look like "command": "uvx", "args": ["mcp-server-git", "--repository", "path/to/git/repo"] }, - "github": { - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-github"], - "env": { - "GITHUB_PERSONAL_ACCESS_TOKEN": "" - } - }, - "postgres": { - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-postgres", "postgresql://localhost/mydb"] + "time": { + "command": "uvx", + "args": ["mcp-server-time"] } } } @@ -133,6 +129,8 @@ Additional examples of using the Claude Desktop as an MCP client might look like On Windows, apply the same wrapper to each `npx`-based entry above by changing `"command"` to `"cmd"` and prepending `"/c", "npx"` to the existing `args`. Leave `uvx` entries unchanged. +Do not configure archived packages such as `@modelcontextprotocol/server-github` or `@modelcontextprotocol/server-postgres` from new setups — see [Archived](#archived). + ## 🛠️ Creating Your Own Server Interested in creating your own MCP server? Visit the official documentation at [modelcontextprotocol.io](https://modelcontextprotocol.io/introduction) for comprehensive guides, best practices, and technical details on implementing MCP servers. From d94fb611b86aa75e839ff50d1fd434955e231201 Mon Sep 17 00:00:00 2001 From: lsmlhi_25 Date: Thu, 10 Sep 2026 22:34:46 +0800 Subject: [PATCH 2/2] docs: add archived-server reporting guidance (#4785) --- SECURITY.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 2d6cdc2be4..c7d17419e8 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -11,6 +11,20 @@ their own MCP servers, not as production-ready solutions. This repository is **not** eligible for security vulnerability reporting. If you discover a vulnerability in an MCP SDK, please report it in the appropriate SDK repository. +### Archived reference servers + +Several older reference servers (for example PostgreSQL, GitHub, Puppeteer, and Brave Search) +were moved to [`servers-archived`](https://github.com/modelcontextprotocol/servers-archived). +That archive states that **no security guarantees** are provided for those servers. + +- Do **not** open public issues here about archived packages; this repo only maintains the + active reference servers listed in the README. +- Prefer replacements from the [MCP Registry](https://registry.modelcontextprotocol.io/) + when available. +- npm deprecation text for archived packages is maintained separately by package publishers; + if you still install an archived package, treat the archive README as the source of truth + for support status. + ## Reporting Security Issues in MCP SDKs If you discover a security vulnerability in an MCP SDK, please report it through the