How many third-party packages each MCP server pulls inside your agent. More packages means more attack surface — not more vulnerabilities. A server with 133 well-maintained dependencies can be safer than one with 6 hand-rolled ones.
▲ marks 1 server where
most of what resolves is prebuilt binaries, so the count understates what you install.
@azure/mcp is 7 packages — all 7 platform binaries, one unpacking to 116 MB of
compiled code. A 569-package tree of plain JavaScript is more auditable, not less.
Read a low number there as less you can inspect, not less you are trusting.
Counts from real npm and pip resolution, refreshed weekly.
Python target 3.12. Not a code audit.