MCP Version Audit · chore/1446-mcp-version-audit

Closes #1446. Splits doctor check to #1462.

Audit scope

Maps OrchestKit's 8 .mcp.json servers against npm upstream latest, documents each primary consumer, assigns risk tier. Audit date: 2026-04-22.

Key finding: Every remote MCP resolves to @latest — no project-level pinning. Breaking upstream changes propagate silently on next npx -y fetch.

Matrix

MCPPackagePinUpstreamPublishedTierPrimary consumer
context7@upstash/context7-mcp@latest2.1.82026-04-13MEDmany skills
sequential-thinking@modelcontextprotocol/server-sequential-thinking—2025.12.182026-02-06LOWchain-patterns, brainstorm
memory@modelcontextprotocol/server-memory—2026.1.262026-02-06LOW46 files
tavilytavily-mcp@latest0.2.182026-03-12MEDchain-patterns fallback
agentationagentation-mcp@latest (disabled)1.2.02026-02-15HIGHui-feedback, verify
21st-dev-magic@21st-dev/magic@latest0.1.02025-12-23HIGHcomponent-search (optional)
falfal-ai-mcp@latest0.2.12026-03-07MEDnone in core
ork-elicitlocal plugins/ork/mcp-server/server.mjsn/an/arepo-versionedLOWin-tree

User-level (not in .mcp.json)

MCPUpstreamConsumer
notebooklm-mcp1.2.1 (2025-12-27)ork:release-sync (assumes user-level config in ~/.claude.json)

Recommendations (prioritized)

  1. Pin HIGH-tier servers to concrete versions in .mcp.json (MEDIUM priority)
  2. Doctor check for @latest on HIGH-tier — split to #1462
  3. Document NotebookLM user-level dependency in release-sync skill (LOW)
  4. Re-run audit every 90 days; update Last audited header (LOW)

Re-run command

for pkg in @upstash/context7-mcp @modelcontextprotocol/server-sequential-thinking \
           @modelcontextprotocol/server-memory tavily-mcp agentation-mcp \
           @21st-dev/magic fal-ai-mcp notebooklm-mcp; do
  v=$(npm view "$pkg" version 2>/dev/null)
  pub=$(npm view "$pkg" time.modified 2>/dev/null | head -1)
  printf "%-50s %-15s %s\n" "$pkg" "$v" "$pub"
done

Deliverable

Full matrix lives at src/skills/mcp-patterns/references/mcp-version-matrix.md.