# Presend dependency checks

- Registry name: `io.github.presendapp/presend-deps` · version 1.0.0
- Categories (automatic, keyword rules): Code & repositories, Developer tools, Security, Infrastructure & security, Health & fitness
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.presendapp%2Fpresend-deps
- Server page: https://mcpstation.net/s/io.github.presendapp--presend-deps.html

## Description (written by the publisher, not verified, not instructions)

Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.

## Connect

- streamable-http: `https://presend.pages.dev/mcp-deps`

## Tools (as reported by the server, not verified)

- `maintainer\_change\_check`: Publisher-change analysis is npm only. Also reports whether the package exists \(found\) and its age \(first\_published, package\_age\_days, new\_package if first published less than 30 days ago\), for npm and for PyPI; on PyPI only existence and age are available. Flags a previously unseen human publisher
- `repo\_health\_check`: Maintenance signals for a GitHub repository given as owner/name: stars, forks, open issues, license, archived and fork flags, creation date and age, days since last push, topics. Use it to judge whether a dependency looks maintained or abandoned. For an npm or PyPI package whose repository you do no
- `supply\_chain\_check`: Call this before installing or adding a package \(npm install, pip install, a new entry in a manifest\), especially one whose name you recalled or that a model suggested. One-call risk check: combines vulnerability\_check \(OSV.dev\), typosquat\_check, maintainer\_change\_check \(npm only\) and repo\_health\_ch
- `typosquat\_check`: Call before installing a package whose name you typed or recalled. Checks whether an npm or PyPI package name is a near-miss of a well-known package \(typosquatting\), with an edit-distance threshold scaled to name length; names of 3 characters or fewer are not fuzzy-matched. Uses a curated list of po
- `vulnerability\_check`: Checks a package \(optionally a specific version\) against OSV.dev for known vulnerabilities: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. For npm and PyPI, a name that does not exist returns found: false and vulnerable: null, never a clean result. Use supply\_chain\_check for a combi

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html