Case file No.352 · pypi · stdio

dead-letter

io.github.BigCactusLabs/dead-letter · v0.4.9

Convert .eml and .mbox email to clean Markdown for RAG, LLM pipelines, and local knowledge bases

Package ↗GitHub ↗

Security score

88/100

Strong

Normalized over 100 points of available evidence.

Score breakdown

Known advisories40/40

0 affecting current version, 0 historical

Maintenance20/20

last push 1 days ago

Source transparency10/15

public repo, license unknown/none

Metadata stability15/15

0 risky metadata change(s) without a version bump

Adoption3/10

377 weekly downloads

Known advisories

source: OSV.dev

No advisories found in OSV for this package name. (Not proof of safety.)

Metadata change timeline

rug-pull detection

v0.4.8 → v0.4.9Oct 24, 2026

version changed version bump
```
"0.4.8" → "0.4.9"
```
packages.0.version changed package version bump
```
"0.4.8" → "0.4.9"
```
packages.0.runtimeArguments.1.value changed version string inside argument
```
"dead-letter[mcp]==0.4.8" → "dead-letter[mcp]==0.4.9"
```

packages.1.identifier changed version-only identifier change

"https://github.com/BigCactusLabs/dead-letter/releases/download/v0.4.8/dead-letter-mcp-0.4.8.mcpb" → "https://github.com/BigCactusLabs/dead-letter/releases/download/v0.4.9/dead-letter-mcp-0.4.9.mcpb"

packages.1.version changed package version bump
```
"0.4.8" → "0.4.9"
```

packages.2.identifier changed image digest changed, same tag

"ghcr.io/bigcactuslabs/dead-letter@sha256:ed4b3665a6d76362d9a1835fe6511c7906524acde3484331fa62998af6e1f30c" → "ghcr.io/bigcactuslabs/dead-letter@sha256:0023516c85b2e5464d7a73cf037289f43d4aa8f44f13dbb6f4e09f5b9f9fa8c7"

First snapshot (v0.4.8)Oct 17, 2026

Tool lists: not published by the registry — unknown.

FAQ

auto-generated from the data above

Is dead-letter safe?

MCPWatch gives dead-letter a heuristic security score of 88/100 (strong), based on 100 points of available evidence. This is an automated heuristic, not an audit.

Does dead-letter have known CVEs or vulnerabilities?

No advisories were found in OSV.dev for the pypi package dead-letter. That is not proof of safety.

When was dead-letter last updated?

The latest registry version is 0.4.9, published Oct 22, 2026. The last push to BigCactusLabs/dead-letter was on Oct 23, 2026. MCPWatch last checked it on Oct 24, 2026.

What license does dead-letter use?

GitHub did not detect a license for BigCactusLabs/dead-letter.

Related servers

same publisher / similar score