@neondatabase/mcp-server-neon is deprecated on npm:
This package is deprecated. Use the remote MCP server at mcp.neon.tech instead.
Last publish was 0.6.5 on 2026-03-02, which is already the version npx/mcp-server-neon/spec.yaml pins, so there is nothing to bump to. Upstream's main is now a Next.js app at 1.0.0 for the hosted service and is never published under this npm name.
The practical consequence is that this server can never pass the build-containers Grype gate. Its abandoned tree exact-pins roughly 30 packages and produces 86 findings, including a critical in next (GHSA-9qr9-h5gf-34mp) and about 34 highs. Clearing that would take ~30 override entries against a package that will never be updated, several of them cross-major, which is not a defensible use of the mechanism from #669.
The remote server has already been added to toolhive-catalog, and there is an open PR there marking this one deprecated.
Proposed: remove npx/mcp-server-neon/ from dockyard. This does not delete the already-published container image, it just stops carrying the spec forward and stops the gate failing on a server nobody should be using.
Context: it was one of the 10 in #830, excluded there because it is not override-shaped.
@neondatabase/mcp-server-neonis deprecated on npm:Last publish was 0.6.5 on 2026-03-02, which is already the version
npx/mcp-server-neon/spec.yamlpins, so there is nothing to bump to. Upstream'smainis now a Next.js app at 1.0.0 for the hosted service and is never published under this npm name.The practical consequence is that this server can never pass the
build-containersGrype gate. Its abandoned tree exact-pins roughly 30 packages and produces 86 findings, including a critical innext(GHSA-9qr9-h5gf-34mp) and about 34 highs. Clearing that would take ~30 override entries against a package that will never be updated, several of them cross-major, which is not a defensible use of the mechanism from #669.The remote server has already been added to toolhive-catalog, and there is an open PR there marking this one deprecated.
Proposed: remove
npx/mcp-server-neon/from dockyard. This does not delete the already-published container image, it just stops carrying the spec forward and stops the gate failing on a server nobody should be using.Context: it was one of the 10 in #830, excluded there because it is not override-shaped.