Why "it runs" doesn't mean "it's usable"
MCP servers have almost no install barrier — one npx command and it's running. But the real question in an enterprise setting is: will this server still be maintained in three months? Is the way it handles credentials safe? How long do its maintainers take to respond to a security vulnerability?
Catalog size and lifecycle counts change with each data snapshot, so use the current leaderboard rather than a hard-coded ecosystem total.
This checklist turns due diligence into repeatable checks you can perform from public data before testing in an isolated environment.
Part 1: Liveness checks (5 must-check items)
1. Check the last commit date and review what recent commits actually changed; recency alone does not prove quality.
2. Review the 90-day commit history for meaningful fixes, releases and dependency maintenance rather than relying on a single threshold.
3. Sample recent issues and confirm whether maintainers reply and close actionable reports. MCP Radar reports the share with replies, not a median response time.
4. Check whether the repo is archived. Treat archived software as unsupported unless a maintained successor is clearly documented.
5. Is there a clear license? Code with no license is legally "all rights reserved" for enterprises — unusable commercially.
Part 2: Security & compliance
6. How are credentials passed? Prefer servers that inject via environment variables; be wary of implementations that require writing a token into a config file — the latter leaks easily in multi-client setups.
7. Any third-party hosted dependencies? Hosted servers (e.g. Firecrawl, Exa) mean your data passes through a third party's servers; evaluate their privacy policy…
Part 3: Adoption cross-check
Treat stars, downloads and forks as context rather than proof. Confirm that the package belongs to the linked repository, releases are recent, and independent users report successful setups.
Appendix: due-diligence checklist
Record repository and package identity, last review date, license, required permissions, credential handling, network destinations, maintenance evidence, rollback plan and an owner for re-review.