Finders get credit

Spotted something bad?

Report a skill, MCP server or package. A person confirms every report before it is listed.

Report something bad Dispute a listing

What is it?

Version

Name

Exactly as it appears in the registry.

Evidence link

A write-up, advisory, issue or the code itself.

What did it do?

Your email

Only for follow-up. Never shown.

Credit me as

What happens next.

A report alone never lists anything.

Now
Received
You get a receipt number.
Within 6 hours
Sorted by code
Duplicates, listed items and OSV matches are settled first.
Once a day
Read by AI
What is left gets one review per package.
Then
Decided by a person
Approved items are signed into the list, with credit.

Listed by mistake? Switch to "Dispute a listing" above. Disputes are answered within 48 hours. How we decide

Sending from a scanner or a script? Use the report API.