{"name":"io.github.julian-martin89/pkg-oracle","slug":"julian-martin89-pkg-oracle","title":"pkg-oracle — Dependency Trust Oracle","description":"Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.","url":"https://mcp.market/server/julian-martin89-pkg-oracle","rating":null,"grade":"C","score":67,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":5,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":8,"ok":8,"last_checked_at":"2026-09-21T09:56:01.074Z","last_ok_at":"2026-09-21T09:56:01.074Z","latency_ms":58},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":null,"version":"1.0.1","remotes":[{"type":"streamable-http","url":"https://mcp-snowy-dew-9447.fly.dev/mcp"}],"packages":[],"tools":[{"name":"verify_package","description":"Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ecosystem":{"type":"string","enum":["npm","pypi"],"description":"Package registry to check the name against."},"name":{"type":"string","minLength":1,"maxLength":214,"description":"Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages)."},"version":{"type":"string","minLength":1,"maxLength":100,"description":"Optional exact version string to verify (e.g. \"4.17.21\"). Omit to check only the package name."}},"required":["ecosystem","name"],"additionalProperties":false,"$schema":"http://json-schema.org/draft-07/schema#"}}],"scan":{"score":67,"grade":"C","scanned_at":"2026-09-20T16:18:47.400Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T16:18:47.365Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 584ms"]},"poisoning":{"score":15,"max":15,"notes":["1 tool descriptions checked"]},"auth":{"score":10,"max":15,"notes":["open endpoint, read-only tools"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":2,"max":10,"notes":["no repository or website to verify"]}},"findings":[{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://mcp-snowy-dew-9447.fly.dev/mcp","reachable":true,"authRequired":false,"latencyMs":584,"serverInfo":{"name":"pkg-oracle","version":"1.0.0"}}],"packages":[],"repo":{"found":false},"icon":{"url":null,"source":"none"},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":5}}}},"grade_history":[],"reviews":[]}