{"name":"io.github.adamsjack711-ux/pkgxray","slug":"adamsjack711-ux-pkgxray","title":"pkgxray","description":"Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.","url":"https://mcp.market/server/adamsjack711-ux-pkgxray","rating":null,"grade":"B","score":74,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":36,"stars":11,"forks":2,"downloads_week":38,"last_push_at":"2026-09-24T08:54:40.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/adamsjack711-ux/pkgxray","website":"https://pkgxray.ca/","version":"1.0.5","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"pkgxray","version":"1.0.5","runtimeHint":"npx","transport":{"type":"stdio"},"packageArguments":[{"value":"mcp-server","type":"positional"}]}],"tools":[],"scan":{"score":74,"grade":"B","scanned_at":"2026-09-24T17:25:38.472Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-24T17:25:38.343Z","components":{"code":{"score":15,"max":25,"notes":["23 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"src/auditor.js: …`devtool:'eval'` wraps every module as `eval(\"<module source>\")`, // and `new Functio…"},{"id":"net.raw-ip","severity":"medium","component":"code","title":"Network call to a raw IP address","evidence":"src/auditor.js: …s not // execute: `// e.g. request.get('https://1.2.3.4/')` (superagent), an Apache // license U…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"pkgxray","version":"1.0.5","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-07-27T01:57:14.175Z","repositoryUrl":"git+https://github.com/adamsjack711-ux/pkgxray.git","weeklyDownloads":38}],"repo":{"found":true,"owner":"adamsjack711-ux","repo":"pkgxray","archived":false,"pushedAt":"2026-09-24T08:54:40Z","stars":11,"forks":2,"openIssues":2,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/264055154?v=4","ownerCreatedAt":"2026-02-26T02:29:56Z","license":"MIT"},"icon":{"url":"https://pkgxray.ca/assets/favicon.svg","source":"site"},"presence":{"stars":11,"forks":2,"downloadsWeek":38,"license":"MIT","lastPushAt":"2026-09-24T08:54:40.000Z","score":36}}}},"grade_history":[],"reviews":[]}