[dave8172]

Listing

Project repository: https://github.com/dave8172/mcplytics

Category and description: Development & Workflow. Usage, health and security signals for remote MCP servers from one zero-dependency wrapper that never stores call arguments, plus a check command that audits your own server and says what to fix.

How you verified the project works: the 54-test suite passes (npm test) on 0.3.0. It covers the wrapper, the Node/Express middleware on real node:http servers, the security signals, and mcplytics check against a deliberately broken server and a correct one. It was also run against the official MCP SDK 1.32.1 (Express JSON and event-stream, and the web-standard transport). It is a library that wraps an MCP server's HTTP handler, not an MCP server itself, so the description has no MCP server: prefix. scripts/check-alphabetical.py passes, and plugin-scanner 3.53.0 scores the repository 100/100.

Added at the invitation of a HOL maintainer on X.

Optional Guard contribution guide

• Send me the optional HOL Guard extension contribution guide.

🤖 Generated with Claude Code

[github-actions]

@dave8172, contribution checks passed. The centralized score threshold of 80 was met; finding severities are advisory. No action is needed. [Latest sweep](https://github.com/hashgraph-online/awesome-ai-plugins/actions/runs/39772926672).

[dave8172]

The centralized scan scored mcplytics at 58 (source commit f322693). All four findings are fixed in dave8172/mcplytics@d3b02cb:

• HARDCODED_SECRET (test/wrap.test.js:184): a synthetic test marker in a variable named secret. Renamed to planted; it was never a credential.
• SECURITY_MD_MISSING: added SECURITY.md, with private vulnerability reporting enabled on the repository.
• DEPENDENCY_LOCKFILE_MISSING: added package-lock.json. The package has zero runtime dependencies.
• DEPENDABOT_MISSING: added .github/dependabot.yml.

plugin-scanner 3.53.0 on the new commit: 100/100, no findings. I rebased the branch onto main, but no new scan has started. Could a maintainer rerun the sweep for this PR? Thanks.