How do I know if an MCP server is abandoned?

An MCP server can keep functioning perfectly well for months after its last real commit — the code doesn't stop running just because nobody's looking at it. That's exactly what makes abandonment dangerous rather than obviously broken: a maintained server and an abandoned one can be functionally indistinguishable to a user, right up until a real vulnerability is found in the abandoned one and nobody's there to fix it.

This is a different failure mode from the ones tool poisoning and rug pulls describe — those are active attacks. Abandonment is closer to a slow-motion risk: the server was fine, still is fine today, but has no realistic path to staying fine once something goes wrong.

Last commit date is the single strongest signal — a repository with no commits in 6+ months, especially with no response to open issues in that window, is the clearest indicator. Last release date matters separately from last commit, since some maintainers commit without ever cutting a release, which leaves users on stale published code even if the repo itself looks active.

Whether the server's live endpoint still actually responds is a distinct, complementary signal — a repository can look untouched while the hosted service behind it silently went down (or the reverse: an endpoint stays up on old, unpatched code long after the repo went quiet). Contributor count matters too, as a bus-factor proxy: a server maintained by a single person carries real abandonment risk even while that person is still active, since there's no continuity if they stop.

None of these signals alone is definitive. A recent commit with a stale release, or a live endpoint with a dead repository, both tell a real story — the point is checking more than one, not picking whichever one looks reassuring.

The Freshness dimension scores exactly these signals directly: last-commit recency and last-release recency (both banded — full credit inside 30 days, partial inside 90 and 180, zero beyond that), plus endpoint liveness inferred from real scan attempts rather than a separate network probe. An archived repository scores zero outright, regardless of any other signal — 'archived' is a maintainer's own explicit statement that a project is done. Maintenance scores contributor count as a bus-factor signal separately, since a single-maintainer project is a real risk even while everything else about it looks current.