Blast radius: path-key

If a vulnerability or a malicious release lands in path-key, this is how much of the MCP agent ecosystem moves underneath its users at once. Measured against our dated dependency census (2026-10-19).

8,080

MCP servers depend on path-key — 70.6% of the measured npm-backed population

1,077 with a live reachable host

maintainers 1 sindresorhus last publish 2021-04-09

Affected servers (sample of 24 of 8,080)

ai.agenticaffiliate/affiliate-networks-mcp · ai.autonomad/travel · ai.bowmark/bowmark · ai.chronary/mcp · ai.ekwo/mcp · ai.etincel/etincel-nonfiction · ai.foura/mcp · ai.gessa/mcp-server · ai.hiddencontent/mcp · ai.i18nagent/i18n-agent · ai.inite/inite-visibility · ai.instantclips/instantclips · ai.intodns/scanner · ai.kavel/kavel-mcp · ai.keenable/web-search · ai.law/lawyer-search · ai.llmintel/model-lifecycle · ai.mails/agent-email · ai.makeaivideo/video-generator · ai.makerportal/compute · ai.meetlark/mcp-server · ai.memcell/memcell · ai.motiblog/mcp · ai.naumu/mcp

Exposure, not accusation. This asserts a measured dependency relationship from public npm metadata. It asserts no vulnerability in path-key and no wrongdoing by its maintainer. It is the reach that would matter if a vulnerability existed — which is the whole point of knowing it before one does. Re-derivable with npm view path-key and our dated census. The floor and its method →