MCP server health signals that actually matter

Useful signals

• Repository archived or gone — maintenance risk is no longer theoretical.
• npm deprecated — upstream told you not to depend on it.
• No push for a long time — may be fine for stable tools; pair with remote liveness for hosted products.
• Live remote handshake — the hosted product still answers (including auth challenges).

Misleading alone

• Star count without identity
• A polished README on a look-alike domain
• “Verified” without reading what it verifies

Where we show them

Lookup table + API card fields. Methodology: methodology.