From 886d76b4bb1f851a4ea8daa457647bc5ae33e9a2 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Wed, 5 Aug 2026 16:08:07 -0400 Subject: [PATCH] chore: remove deprecated mcp-server-neon wrapper @neondatabase/mcp-server-neon is deprecated on npm in favor of the hosted server at mcp.neon.tech. Its last publish was 0.6.5 on 2026-03-02, which is already the version pinned here, so there is nothing to bump to. Upstream's main is now a Next.js app for the hosted service and is never published under this npm name. The practical effect is that this server can never pass the Grype gate: its abandoned tree exact-pins roughly 30 packages and produces 86 findings, including a critical in next (GHSA-9qr9-h5gf-34mp) and about 34 highs. Clearing that would take ~30 override entries against a package that will never be updated, which is not a defensible use of the mechanism added in #669. The remote server is already in toolhive-catalog. Removing the spec does not delete the published image, it just stops carrying it forward. Closes #835 --- npx/mcp-server-neon/spec.yaml | 31 ------------------------------- 1 file changed, 31 deletions(-) delete mode 100644 npx/mcp-server-neon/spec.yaml diff --git a/npx/mcp-server-neon/spec.yaml b/npx/mcp-server-neon/spec.yaml deleted file mode 100644 index b25e9f94..00000000 --- a/npx/mcp-server-neon/spec.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Neon MCP Server Configuration -# MCP server for interacting with Neon Management API and databases -# Package: https://www.npmjs.com/package/@neondatabase/mcp-server-neon -# Repository: https://github.com/neondatabase-labs/mcp-server-neon -# Will build as: ghcr.io/stacklok/dockyard/npx/mcp-server-neon:0.6.3 - -metadata: - name: mcp-server-neon - description: "MCP server for interacting with Neon Management API and databases" - protocol: npx - -spec: - package: "@neondatabase/mcp-server-neon" - version: "0.6.5" - -provenance: - repository_uri: "https://github.com/neondatabase-labs/mcp-server-neon" - repository_ref: "refs/heads/main" - -security: - # Server requires NEON_API_KEY to start - cannot be scanned in CI - insecure_ignore: true - allowed_issues: - - code: "AITech-12.1" - reason: "Tool descriptions use structured XML-like documentation (e.g., , ) to provide AI assistants with workflow guidance. This is legitimate documentation pattern for MCP tools, not tool poisoning." - - code: "AITech-1.1" - reason: "Tool descriptions contain SQL examples and structured workflow instructions with MUST directives for database migration and query tuning tools. These are legitimate documentation patterns, not prompt injection attacks." - - code: "AITech-9.1" - reason: "SQL examples in prepare_database_migration tool description (e.g., ALTER TABLE, SELECT) are documentation showing usage patterns, not SQL injection payloads." - - code: "AITech-8.2" - reason: "The provision_neon_auth tool legitimately provisions authentication credentials and explains how to use them. References to credential names in documentation are necessary for proper tool usage, not credential harvesting."