All servers · AI models & agents
pkg-oracle — Dependency Trust Oracle
io.github.julian-martin89/pkg-oracle · v1.0.1
Measured by MCP Station
| Last check | Reachable |
|---|---|
| Checked at | — |
| Check success 7 / 30 days | — |
| First-try success 30 days | — |
| Median response | — |
| Lookups 30 days | — |
| Authentication | No auth |
| MCP version | 2025-06-18 |
| Rank score | — |
| Declared risk | Not declared (tools carry no read/destructive hints) |
| Capabilities declared | tools |
| Tool definitions | 1 tools · with description 100% · input schema is an object 100% · read/destructive hints 0% |
Description written by the publisher, not verified
Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.
Connect
streamable-http · https://mcp-snowy-dew-9447.fly.dev/mcp
claude mcp add --transport http pkg-oracle https://mcp-snowy-dew-9447.fly.dev/mcp{
"mcpServers": {
"pkg-oracle": {
"url": "https://mcp-snowy-dew-9447.fly.dev/mcp"
}
}
}Tools as reported by the server
verify_packageDependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, Cargo.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev,
JSON · Text for agents · Registry updated 2026-09-03