Why "it runs" doesn't mean "it's usable"
MCP servers have almost no install barrier — one npx command and it's running. But the real question in an enterprise setting is: will this server still be maintained in three months? Is the way it handles credentials safe? How long do its maintainers take to respond to a security vulnerability?
We tracked maintenance data for 1,247 MCP servers: 137 are abandoned and 168 haven't been updated in over six months — meaning if you pick one at random from an "awesome MCP" list, there's nearly a one-in-four chance of hitting a zombie project.
This checklist turns due diligence into 12 tickable items, all doable in 15 minutes from public data.
Part 1: Liveness checks (5 must-check items)
1. Is the last commit < 30 days ago? For projects past 90 days, issue response rate falls off a cliff to under 20%.
2. Are there > 10 commits in 90 days? Below that, projects usually only have "life-support commits" (README tweaks, version bumps).
3. Is the median open-issue response time < 7 days? Sort the repo's Issues page by "recently commented" to judge quickly.
4. Is the repo archived? An archived repo's API dependencies rot over time, typically becoming unusable after ~6 months.
5. Is there a clear license? Code with no license is legally "all rights reserved" for enterprises — unusable commercially.