Case file No.038 · npm · stdio

Marrow AI: Control Layer for AI Agents

ai.getmarrow/marrow · v3.9.103

Approval gate and audit trail for AI agent actions: policy check first, proof after. Any MCP client.

Package ↗GitHub ↗Website ↗

Security score

96/100

Strong

Normalized over 100 points of available evidence.

Score breakdown

Known advisories40/40

0 affecting current version, 0 historical

Maintenance20/20

last push 4 days ago

Source transparency15/15

public repo, license MIT

Metadata stability15/15

0 risky metadata change(s) without a version bump

Adoption6/10

2172 weekly downloads

Known advisories

source: OSV.dev

No advisories found in OSV for this package name. (Not proof of safety.)

Metadata change timeline

rug-pull detection

v3.9.102 → v3.9.103Oct 17, 2026

version changed version bump
```
"3.9.102" → "3.9.103"
```

description changed description text edit

"A named yes before your AI agent acts, plus proof the next agent can reuse. Works in any MCP client." → "Approval gate and audit trail for AI agent actions: policy check first, proof after. Any MCP client."

packages.0.version changed package version bump
```
"3.9.102" → "3.9.103"
```

First snapshot (v3.9.102)Oct 16, 2026

Tool lists: not published by the registry — unknown.

FAQ

auto-generated from the data above

Is Marrow AI: Control Layer for AI Agents safe?

MCPWatch gives Marrow AI: Control Layer for AI Agents a heuristic security score of 96/100 (strong), based on 100 points of available evidence. This is an automated heuristic, not an audit.

Does Marrow AI: Control Layer for AI Agents have known CVEs or vulnerabilities?

No advisories were found in OSV.dev for the npm package @getmarrow/mcp. That is not proof of safety.

When was Marrow AI: Control Layer for AI Agents last updated?

The latest registry version is 3.9.103, published Oct 17, 2026. The last push to getmarrow/marrow-mcp was on Oct 17, 2026. MCPWatch last checked it on Oct 21, 2026.

What license does Marrow AI: Control Layer for AI Agents use?

GitHub reports the license of getmarrow/marrow-mcp as MIT.

Related servers

same publisher / similar score