Make Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Make Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This stdio-fork MCP server is no longer maintained. Migrate to the official Make.com cloud MCP.
Three orphan-storm failure modes (1–3) were patched in v1.4.0–v1.4.2, but a fourth mode (libuv read-callback CPU loop on macOS Sequoia) emerged in v1.4.2 and proved difficult to detect from inside the runaway process. Rather than continue patching a stdio-spawn-based architecture, D1DX migrated all its MCP consumers to Make.com's first-party cloud MCP (Streamable HTTP, no spawned processes).
Make.com publishes an official Streamable HTTP MCP at:
https://eu1.make.com/mcp/stateless (EU1 region)https://eu2.make.com/mcp/stateless (EU2 region)Auth is Authorization: Bearer <MAKE_API_KEY> (mint at https://www.make.com/en/help/api/working-with-tokens).
.mcp.json){
"mcpServers": {
"make": {
"type": "http",
"url": "https://eu1.make.com/mcp/stateless",
"headers": {
"Authorization": "Bearer <MAKE_API_KEY>"
}
}
}
}.codex/config.toml)[mcp_servers.make]
url = "https://eu1.make.com/mcp/stateless"
[mcp_servers.make.http_headers]
Authorization = "Bearer <MAKE_API_KEY>".gemini/settings.json){
"mcpServers": {
"make": {
"httpUrl": "https://eu1.make.com/mcp/stateless",
"headers": {
"Authorization": "Bearer <MAKE_API_KEY>"
}
}
}
}Any npx -y github:D1DX/make-mcp install of this repo (version 99.0.0-retired) will:
postinstall (exit 0 so package managers don't crash).make-mcp-server invocation.The stub has no dependencies and no build step.
For the orphan-storm investigation that drove this retirement, see tasks/NO-ID (make-mcp-orphan-research)/ in D1DX/d1dx. The four documented failure modes:
| Mode | Trigger | Fix attempt |
|---|---|---|
| 1 | Direct orphan, no wrapper | 70be8d6 (2026-04-25) — stdin-close handler |
| 2 | Orphan-of-orphan, stdin error event | 95899b1 (2026-04-29, v1.4.1) — bounded rejection counter |
| 3 | Orphan-of-orphan, no stdin error | 129ba7b (2026-05-01, v1.4.2) — out-of-process worker watchdog |
| 4 | libuv read-callback CPU loop on Sequoia (no rejection event, watchdog falsely-live) | unfixed — retired |
MIT (see LICENSE).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.