Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, Cargo.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.
Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages).
Package registry to check the name against.
Optional exact version string to verify (e.g. "4.17.21"). Omit to check only the package name.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, Cargo.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.
| Argument | Type | Description |
|---|---|---|
| name* | string | Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages). |
| version | string | Optional exact version string to verify (e.g. "4.17.21"). Omit to check only the package name. |
| ecosystem* | string | Package registry to check the name against. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"minLength": 1,
"description": "Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages)."
},
"version": {
"type": "string",
"maxLength": 100,
"minLength": 1,
"description": "Optional exact version string to verify (e.g. \"4.17.21\"). Omit to check only the package name."
},
"ecosystem": {
"enum": [
"npm",
"pypi",
"crates.io"
],
"type": "string",
"description": "Package registry to check the name against."
}
},
"additionalProperties": false
}