timeahead-mcp
MCP server for timeahead.in — live, independent trust scores for MCP servers.
timeahead scores 800+ MCP servers nightly across five dimensions: security (35%), freshness (25%), adoption (20%), quality (10%), and trust (10%). This package gives any AI assistant (Claude Desktop, Cursor, Cline, Continue) direct access to those scores so it can answer questions like "which Postgres MCP is safest?" with live data instead of stale training.
Install
# One-time global install
uvx timeahead-mcp
# Or add to mcp.json
{
"mcpServers": {
"timeahead": {
"command": "uvx",
"args": ["timeahead-mcp"],
"env": {
"TIMEAHEAD_API_KEY": "ta_mcp_..."
}
}
}
}
The TIMEAHEAD_API_KEY is optional. Without it you get 200 requests/hour (anonymous). Get a free key at timeahead.in for 500 req/hr.
Tools
Discovery
| Tool | Description |
|---|---|
search_servers |
Search by keyword. Filters: registry, min_score, risk_class. |
list_categories |
All 16 tracked categories (postgres, github, slack, etc.) with counts. |
get_new_servers |
Servers discovered in the last N days. |
get_trending |
Most-downloaded servers this week. |
Trust & Inspection
| Tool | Description |
|---|---|
get_score |
Full 0-100 score with per-dimension breakdown and human-readable notes. |
get_findings |
Security findings, capability flags, maintenance health, install result. |
get_server_detail |
Everything in one call: score + findings + install command. |
compare_servers |
Side-by-side comparison of 2-5 servers with a rule-based recommendation. |
Risk & History
| Tool | Description |
|---|---|
get_score_history |
Score trend over N days (improving / stable / declining). |
get_score_drops |
Servers whose score dropped most in the last N days. |
audit_my_stack |
Audit all servers in your mcp.json. Returns aggregate risk, per-server action (keep/review/replace), and a plain-English summary. |
Recommendations
| Tool | Description |
|---|---|
recommend_for_task |
"I need to read GitHub issues and post Slack messages" → top-scored servers that match. |
recommend_safer_alternative |
Given a low-scored server, returns higher-scored alternatives covering the same domain. |
AI News Feed
| Tool | Description |
|---|---|
get_latest_news |
Latest articles from 48+ AI and tech sources. Filter by category or source. |
search_news |
Keyword search across all articles. |
get_digest |
Curated digests: top-this-week, most-downloaded, new-arrivals, worst-security, security-regressions. |
Example prompts
"Which Postgres MCP server should I install?"
→ search_servers("postgres", min_score=70)
"Is my current MCP setup safe? Here are my installed servers: [slugs]"
→ audit_my_stack([...])
"What changed in MCP security this week?"
→ get_score_drops(days=7)
"Find me a safer alternative to filesystem-mcp"
→ recommend_safer_alternative("filesystem-mcp")
"Should I use mcp-server-postgres or mcp-postgres-pro?"
→ compare_servers(["mcp-server-postgres", "mcp-postgres-pro"])
"What's happening in AI this week?"
→ get_latest_news(limit=5)
Environment variables
| Variable | Default | Description |
|---|---|---|
TIMEAHEAD_BASE_URL |
https://timeahead.in |
Backend URL (change for self-hosted) |
TIMEAHEAD_API_KEY |
(empty) | Optional API key for higher rate limits |
TIMEAHEAD_TIMEOUT |
15 |
HTTP timeout in seconds |
Scoring methodology
Scores are computed nightly by scanning each server's repository (Gitleaks for secrets, AST analysis for capability flags), fetching GitHub maintenance metrics, and checking weekly download counts from npm/PyPI.
timeahead's own MCP server is scored on the same rubric with no special treatment. View the methodology.
License
MIT — see LICENSE.
Metadata
Release files for timeahead-mcp 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| timeahead_mcp-0.1.0.tar.gz | 9.6 kB | With provenance | Details for timeahead_mcp-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| timeahead_mcp-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for timeahead_mcp-0.1.0-py3-none-any.whl |
Total release size: 21.3 kB
Release files / timeahead_mcp-0.1.0.tar.gz
| Download URL | timeahead_mcp-0.1.0.tar.gz |
|---|---|
| Size | 9.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ae35fccf1d17fcf9f0aeb13465ae478377b1fbe28e3d43cf8ddf9162450ac59f
|
|
BLAKE2b-256 checksum How to use checksums |
aa9bf448133f5bc6b7bb6bd0598b20df8873e9382b425750c53d7d885bf85069
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 4, 2026.
Transparency logRelease files / timeahead_mcp-0.1.0-py3-none-any.whl
| Download URL | timeahead_mcp-0.1.0-py3-none-any.whl |
|---|---|
| Size | 11.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b7caff1f0a66e1aabea7c2d6b898220ddd434e2537eb2fcc841ef1c7726223fc
|
|
BLAKE2b-256 checksum How to use checksums |
64e8191ab7e0d845ea123e50c9a1e486b536ab6fec11cb9124084b41876b1004
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 4, 2026.
Transparency logSecurity for timeahead-mcp 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for timeahead_mcp-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 4, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.