Check PyPI/npm packages or a whole lockfile before install: CVEs, typosquats, verdict. 50 free.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Before your agent runs pip install or npm install, check a package list or a whole lockfile (requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml, yarn.lock; one verdict per unique package, with line numbers where the format has them). Per package: does it exist, age, releases, downloads, known vulnerabilities (OSV) for the given or latest version, typosquat and slopsquat signals, install scripts; verdict ok, caution or block with reasons. PyPI and npm. A clean ok is not a guarantee. Costs $0.002 USDC per package on Base via x402: the first call without payment returns the payment requirements; pay with an x402-capable MCP client (_meta['x402/payment']) or call POST https://package-check-qy40.onrender.com/check over HTTP x402. Free trial: the first 50 packages per payer wallet are free; sign as usual, the server verifies the signature and does not settle; the result shows free_trial_remaining. About 50: the counter is in memory and resets on restart.
lockfile only: check just the first N unique packages (in file order), e.g. 50 for the free trial
raw content of requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml or yarn.lock; parsed to unique packages
lockfile only: false drops packages marked dev
optional; auto-detected from the content
Before your agent runs pip install or npm install, check a package list or a whole lockfile (requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml, yarn.lock; one verdict per unique package, with line numbers where the format has them). Per package: does it exist, age, releases, downloads, known vulnerabilities (OSV) for the given or latest version, typosquat and slopsquat signals, install scripts; verdict ok, caution or block with reasons. PyPI and npm. A clean ok is not a guarantee. Costs $0.002 USDC per package on Base via x402: the first call without payment returns the payment requirements; pay with an x402-capable MCP client (_meta['x402/payment']) or call POST https://package-check-qy40.onrender.com/check over HTTP x402. Free trial: the first 50 packages per payer wallet are free; sign as usual, the server verifies the signature and does not settle; the result shows free_trial_remaining. About 50: the counter is in memory and resets on restart.
| Argument | Type | Description |
|---|---|---|
| limit | integer | lockfile only: check just the first N unique packages (in file order), e.g. 50 for the free trial |
| lockfile | string | raw content of requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml or yarn.lock; parsed to unique packages |
| packages | array | |
| include_dev | boolean | lockfile only: false drops packages marked dev |
| lockfile_format | string | optional; auto-detected from the content |
{
"type": "object",
"anyOf": [
{
"required": [
"packages"
]
},
{
"required": [
"lockfile"
]
}
],
"properties": {
"limit": {
"type": "integer",
"maximum": 500,
"minimum": 1,
"description": "lockfile only: check just the first N unique packages (in file order), e.g. 50 for the free trial"
},
"lockfile": {
"type": "string",
"description": "raw content of requirements.txt, poetry.lock, uv.lock, Pipfile.lock, package-lock.json, pnpm-lock.yaml or yarn.lock; parsed to unique packages"
},
"packages": {
"type": "array",
"items": {
"type": "object",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214
},
"version": {
"type": "string",
"description": "exact version; omitted = latest"
},
"ecosystem": {
"enum": [
"pypi",
"npm"
],
"type": "string"
}
}
},
"maxItems": 500,
"minItems": 1
},
"include_dev": {
"type": "boolean",
"default": true,
"description": "lockfile only: false drops packages marked dev"
},
"lockfile_format": {
"enum": [
"requirements.txt",
"poetry.lock",
"uv.lock",
"Pipfile.lock",
"package-lock.json",
"pnpm-lock.yaml",
"yarn.lock"
],
"type": "string",
"description": "optional; auto-detected from the content"
}
},
"description": "packages (list) or lockfile (raw text), 1 to 500 unique packages. Price: $0.002 per unique package, paid with x402 (USDC on Base). First 50 packages per payer wallet free."
}Free. Replays the published known-answer set v1 (11 cases) against the live registries and returns score and sha256, so you can verify the check before paying.
| Argument | Type | Description |
|---|---|---|
| details | boolean |
{
"type": "object",
"properties": {
"details": {
"type": "boolean",
"default": false
}
}
}