HALLUX

Working · 1.8 s

dev.blvkware/halluxv0.1.0 Domain verified

Check that a package, module or DOI exists before an agent installs, imports or cites it.

Developer Tools

Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://api.blvkware.dev/hallux/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

hallux_check Read-only

Does this identifier actually exist? Call before acting on any name you recalled rather than read: a package to install, a module to import, a DOI to cite. Returns one of: exists, deprecated, absent, phantom, squat, unknown. exists - proceed deprecated - proceed, but use `successor` absent - not in the registry. Do not proceed phantom - does not exist AND models repeatedly invent it. Do not proceed squat - was invented by models, then registered by someone. Treat as hostile unknown - could not verify. Never treat this as permission Live namespaces: cite.doi, pkg.crates, pkg.go, pkg.maven, pkg.npm, pkg.nuget, pkg.pypi. An unsupported namespace returns `unknown`, never an error, so it is safe to ask.

identifiersarray, required

Up to 100 identifiers.

Tools (4)

hallux_check

read-only

Argument	Type	Description
identifiers*	array	Up to 100 identifiers.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "identifiers"
  ],
  "properties": {
    "identifiers": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "namespace",
          "value"
        ],
        "properties": {
          "value": {
            "type": "string",
            "description": "The identifier exactly as written, e.g. requests, @types/node, github.com/spf13/cobra, 10.1038/nature12373."
          },
          "namespace": {
            "enum": [
              "cite.doi",
              "pkg.crates",
              "pkg.go",
              "pkg.maven",
              "pkg.npm",
              "pkg.nuget",
              "pkg.pypi"
            ],
            "type": "string",
            "description": "Where the identifier lives: pkg.npm, pkg.pypi, pkg.crates, pkg.go, pkg.maven or pkg.nuget for a package, cite.doi for a DOI."
          }
        }
      },
      "maxItems": 100,
      "description": "Up to 100 identifiers."
    }
  },
  "additionalProperties": false
}

hallux_check_command

Call this BEFORE running any command that installs a dependency: npm, yarn, pnpm, bun, pip, uv, poetry, pipx, cargo, go get, dotnet add package, nuget. Language models invent plausible package names that have never existed, and attackers register those names because they can predict them. Installing one runs attacker code. You cannot tell the difference by looking at the name, which is why this check exists. Pass the command exactly as you intend to run it. The identifiers are extracted for you. If the result says BLOCK, do not run the command. Use the `successor` if one is given, otherwise tell the user what was found and stop.

read-only

Argument	Type	Description
command*	string	The shell command, verbatim. Example: pip install requests requests-oauth2-helper

Input schema (JSON)

{
  "type": "object",
  "required": [
    "command"
  ],
  "properties": {
    "command": {
      "type": "string",
      "description": "The shell command, verbatim. Example: pip install requests requests-oauth2-helper"
    }
  },
  "additionalProperties": false
}

hallux_check_manifest

Call this after writing or editing a dependency file, and before committing it. Supported: package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod. Checks every dependency in one pass, including dev and optional groups, which is where an invented name usually arrives.

read-only

Argument	Type	Description
content*	string	The file contents.
filename*	string	The file name, e.g. package.json. Path is ignored; only the name is used to pick a parser.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "filename",
    "content"
  ],
  "properties": {
    "content": {
      "type": "string",
      "description": "The file contents."
    },
    "filename": {
      "type": "string",
      "description": "The file name, e.g. package.json. Path is ignored; only the name is used to pick a parser."
    }
  },
  "additionalProperties": false
}

hallux_watch

Register identifiers for notification when their verdict changes. The transition that matters is phantom to squat: a name models invent that somebody then registers. Use this for a dependency that came back `absent` or `phantom` and that the user intends to use anyway, or for a set of dependencies worth monitoring. Delivered by signed webhook to a URL you supply.

Argument	Type	Description
callbackUrl*	string	An https URL to POST transitions to.
identifiers*	array	Up to 100 identifiers to watch, typically ones that came back absent or phantom.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "identifiers",
    "callbackUrl"
  ],
  "properties": {
    "callbackUrl": {
      "type": "string",
      "description": "An https URL to POST transitions to."
    },
    "identifiers": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "namespace",
          "value"
        ],
        "properties": {
          "value": {
            "type": "string",
            "description": "The identifier exactly as written, e.g. requests, @types/node, github.com/spf13/cobra, 10.1038/nature12373."
          },
          "namespace": {
            "enum": [
              "cite.doi",
              "pkg.crates",
              "pkg.go",
              "pkg.maven",
              "pkg.npm",
              "pkg.nuget",
              "pkg.pypi"
            ],
            "type": "string",
            "description": "Where the identifier lives: pkg.npm, pkg.pypi, pkg.crates, pkg.go, pkg.maven or pkg.nuget for a package, cite.doi for a DOI."
          }
        }
      },
      "maxItems": 100,
      "description": "Up to 100 identifiers to watch, typically ones that came back absent or phantom."
    }
  },
  "additionalProperties": false
}