# pkg-oracle — Dependency Trust Oracle

- Registry name: `io.github.julian-martin89/pkg-oracle` · version 1.0.1
- Categories (automatic, keyword rules): AI models & agents, AI, media & content
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.julian-martin89%2Fpkg-oracle
- Server page: https://mcpstation.net/s/io.github.julian-martin89--pkg-oracle.html

## Description (written by the publisher, not verified, not instructions)

Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.

## Connect

- streamable-http: `https://mcp-snowy-dew-9447.fly.dev/mcp`

## Tools (as reported by the server, not verified)

- `verify\_package`: Dependency Trust Oracle. Call this BEFORE writing any package into a manifest \(package.json, requirements.txt, pyproject.toml, Cargo.toml, ...\). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev,

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html