Learn

Which official MCP reference servers are deprecated?

Quick answer. npm currently marks 6 of the @modelcontextprotocol/server-* reference servers as deprecated — “Package no longer supported”: @modelcontextprotocol/server-brave-search, @modelcontextprotocol/server-gdrive, @modelcontextprotocol/server-github, @modelcontextprotocol/server-postgres, @modelcontextprotocol/server-puppeteer, @modelcontextprotocol/server-slack. Still published without a deprecation notice: @modelcontextprotocol/server-everything, @modelcontextprotocol/server-filesystem, @modelcontextprotocol/server-map, @modelcontextprotocol/server-memory, @modelcontextprotocol/server-sequential-thinking, @modelcontextprotocol/server-threejs, @modelcontextprotocol/server-transcript. These were the canonical examples for two years, so they are what an assistant recommends from memory.

Which ones does npm mark as no longer supported?

packagelatestevidence
@modelcontextprotocol/server-brave-search0.6.2measurement
@modelcontextprotocol/server-gdrive2025.1.14measurement
@modelcontextprotocol/server-github2025.4.8measurement
@modelcontextprotocol/server-postgres0.6.2measurement
@modelcontextprotocol/server-puppeteer2025.5.12measurement
@modelcontextprotocol/server-slack2025.4.25measurement

Why does an AI assistant still recommend them?

Because they were the reference implementation when its training data was collected. A model has no way to observe a deprecation flag published afterwards, and npm will install a deprecated package without failing — it prints a warning most agents never surface.

How do I check before installing?

One request, no account:

curl -s 'https://tashan.sh/v0.1/lookup?name=@modelcontextprotocol/server-github'

Or hand over a whole config and get every risk back at once with POST /v0.1/audit. Both are free and need no account.

What should be used instead?

tashan does not pick a favourite by hand. The task hubs rank what is measured and maintained for each job — and the ranking excludes anything carrying a live advisory or a deprecation notice, which is exactly how these packages drop out of it.

FAQ

Does deprecated mean unsafe?

No. It means the author has said they are no longer supporting it, so bugs and vulnerabilities will not be fixed. Deprecation and a security advisory are separate facts and tashan reports them separately.

Is this list current?

It is regenerated from npm every night. The page only renders the packages carrying a deprecation notice at the time of the last run.

See the ranked Index ›

tashan Pro$6/mo

This article, and every score it links to, is free and needs no account. npx tashan-cli doctor reads the config you already have and names what is wrong in it, also free. What Pro adds is the watch: the day one of them changes.

  • Every score since we started measuring, for any capability
  • The named replacement when something you run is dying — not just that it is
  • tashan doctor over the config you already have, on your machine

Start a 7-day trial › Everything measured on this page stays free.