Check npm and PyPI packages exist before install: versions, age, downloads, look-alikes.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.
1 to 10 packages to look up.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http notary https://notary.clawhard.com/mcp
Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.
| Argument | Type | Description |
|---|---|---|
| packages* | array | 1 to 10 packages to look up. |
{
"type": "object",
"required": [
"packages"
],
"properties": {
"packages": {
"type": "array",
"items": {
"type": "object",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"minLength": 1,
"description": "The package name only, e.g. left-pad, @types/node or requests. No version, extras (requests[security]), URL or path."
},
"version": {
"type": "string",
"maxLength": 64,
"description": "Optional: one exact version to verify, e.g. 4.17.21 (npm also accepts a dist-tag like latest). Not a range such as ^4.17.0."
},
"ecosystem": {
"enum": [
"npm",
"pypi"
],
"type": "string",
"description": "Which registry: npm (JavaScript, TypeScript, Node) or pypi (Python)."
}
}
},
"maxItems": 10,
"minItems": 1,
"description": "1 to 10 packages to look up."
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 9, 2026.