Bridge MCP

Why this score

134 public GitHub projects have this in their committed setup (counted 2026-10-07). That counts people who kept it, not people who starred it. Private projects aren't visible, so the real number is higher.

Popularity score: 54/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

Security

Scanned Nov 4, 2026 at the PyPI package bridge-mcp@2.1.0, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.

What its code does:

• Runs shell commands Common for dev tools. Read the commands it runs.local_agent_tools/app_tools.py:51, local_agent_tools/system_tools.py:25, registry/tools/admin/takedown.sh:28 and 2 more
• Makes network requestsai_overlay.py:373, local_agent_tools/browser_tools.py:145 and 1 more
• Uses dependencies without a pinned version A later version of a dependency could change what runs.pyproject.toml:10, servers/src/fetch/pyproject.toml:19, servers/src/git/pyproject.toml:19 and 22 more

Web addresses in its code:

• static.modelcontextprotocol.ioregistry/cmd/publisher/commands/publish_test.go:42
• registry.npmjs.orgregistry/internal/validators/validators_test.go:267
• docker.ioregistry/internal/validators/registries/oci_test.go:202
• registry.modelcontextprotocol.ioregistry/cmd/publisher/commands/login.go:19
• accounts.google.comregistry/deploy/pkg/k8s/registry.go:153
• api.github.comregistry/internal/api/handlers/v0/auth/github_at.go:37
• victoriametrics.github.ioregistry/deploy/pkg/k8s/monitoring.go:33
• bad-url.comregistry/internal/validators/validation_types_test.go:65
• google.comlocal_agent.py:328
• storage.googleapis.comregistry/deploy/pkg/providers/gcp/provider.go:300
• token.actions.githubusercontent.comregistry/internal/api/handlers/v0/auth/github_oidc.go:62
• acme-v02.api.letsencrypt.orgregistry/deploy/pkg/k8s/cert_manager.go:55
• api.microsoft.comregistry/internal/service/registry_service_test.go:40
• api.nuget.orgregistry/pkg/model/constants.go:16
• bitbucket.orgregistry/internal/validators/validators_test.go:289

And 14 more.

These are the sites named in the code, so it's where your data could go. It isn't a complete list: code can build addresses while it runs, and a few of these may be links rather than calls. Whatever you send also goes to the AI model you use.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.