{"name":"net.pkgproof/pkgproof","slug":"pkgproof","title":"pkgproof","description":"Verify an npm package before you install it: advisories, install scripts, typosquats, provenance.","url":"https://mcp.market/server/pkgproof","rating":null,"grade":"B","score":82,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":31,"stars":0,"forks":0,"downloads_week":442,"last_push_at":"2026-09-14T13:15:17.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/jahija-okan/pkgproof-mcp","website":"https://pkgproof.net","version":"0.1.7","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"@pkgproof/mcp","version":"0.1.7","transport":{"type":"stdio"},"environmentVariables":[{"description":"Base64 account key of a throwaway Algorand wallet holding USDC (ASA 31566704) on Algorand Mainnet. Not a 25-word mnemonic. Optional: the first verification each day is free without any key. This is the rail payments prefer.","isSecret":true,"name":"PKGPROOF_ALGORAND_PRIVATE_KEY"},{"description":"0x-prefixed private key of a throwaway EVM wallet holding USDC on Base. Optional, and only used when no Algorand key is configured. Needs no ETH: payment is an off-chain signature and the facilitator pays the gas.","isSecret":true,"name":"PKGPROOF_BASE_PRIVATE_KEY"}]}],"tools":[{"name":"verify_package","description":"Verify an npm package before installing it. Runs eight checks covering advisories,","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":82,"grade":"B","scanned_at":"2026-09-19T20:02:49.844Z","report":{"scannerVersion":"0.1.5","scannedAt":"2026-09-19T20:02:49.800Z","components":{"code":{"score":25,"max":25,"notes":["8 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 5 days ago"]},"identity":{"score":7,"max":10,"notes":["namespace and repository owner differ","GitHub account older than a year","website matches verified namespace"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"@pkgproof/mcp","version":"0.1.7","found":true,"license":"Apache-2.0","hasInstallScripts":false,"dependencyCount":6,"publishedAt":"2026-09-14T13:17:09.293Z","repositoryUrl":"git+https://github.com/jahija-okan/pkgproof-mcp.git","weeklyDownloads":442}],"repo":{"found":true,"owner":"jahija-okan","repo":"pkgproof-mcp","archived":false,"pushedAt":"2026-09-14T13:15:17Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/57103143?v=4","ownerCreatedAt":"2019-10-28T14:47:15Z","license":"Apache-2.0"},"icon":{"url":"https://pkgproof.net/icon.svg","source":"registry"},"presence":{"stars":0,"forks":0,"downloadsWeek":442,"license":"Apache-2.0","lastPushAt":"2026-09-14T13:15:17.000Z","score":31}}}},"grade_history":[],"reviews":[]}