Is @payloadcms/plugin-mcp secure?

Legit.Show measured @payloadcms/plugin-mcp's Security frame at 100/100. No Content-Security-Policy and no HSTS.

How does Legit.Show measure @payloadcms/plugin-mcp?

Legit.Show scores seven frames — Performance, Accessibility, Security, Privacy, Reliability, Standards and Discoverability — deterministically from the public surface (URL, HTTP headers, real Lighthouse), with no LLM in the scoring path. See legit.show/methodology.

npm · CLI/library

@payloadcms/plugin-mcp

MCP (Model Context Protocol) capabilities with Payload

100/100

7-Frame production-readiness — according to Legit.Show

Is @payloadcms/plugin-mcp production-ready?

Legit.Show measured @payloadcms/plugin-mcp at 100 out of 100 on its 7-Frame production-readiness benchmark (github assessment). Its strongest frame is Security (100); its weakest is Maintenance (100). Every frame is measured deterministically from the public surface — exactly what was observed is shown below.

The 7 Frames

Security — 100/100
Standards — 100/100
Discoverability — 100/100
Maintenance — 100/100

What we measured

No Content-Security-Policy and no HSTS.
No privacy policy found.
Sets cookies / loads scripts with no consent prompt.

Visit @payloadcms/plugin-mcp → · How this was measured →