Pkgtruth MCP server

by hxckya·io.github.hxckya/pkgtruth·v0.2.2

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

A89/100grade A

What users say

No reviews yet

Safety scan

A89/100

Adoption

Growing

4 stars77 downloads/wk

Reviews

Nobody has reviewed Pkgtruth yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

check_dependencies
Verify many npm or PyPI packages at once — use this before writing a package.json or requirements.txt,
check_install_command
Verify the packages a shell command would install or execute, before running it:
check_package
Verify a single npm or PyPI package before installing, importing, or recommending it.

scanner v0.1.5 · 2026-09-19 · same rubric, same numbers if you re-run it

no findings

Code scan13 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 6 days ago15/15
Maintainer identityregistry namespace matches repository owner6/10

Overall 89/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y pkgtruth on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add pkgtruth -- npx -y pkgtruth

Is Pkgtruth MCP server safe?: Yes, by our scan: it is graded A (89/100). Read the Pkgtruth safety report
How do I install Pkgtruth?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Pkgtruth need an API key?: No secret keys are declared. It reads 4 settings from the environment.
Is Pkgtruth maintained?: The last commit was 6 days ago (2026-09-14). The latest release is v0.2.2.
What can I use instead of Pkgtruth?: Servers from other publishers that do the same job: SkillTotal MCP server, mcpm MCP server and MCP server. Compare all Pkgtruth alternatives.

Same job from other publishers: the closest match first, then the best rated.

SkillTotal
Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.
not reviewed
Growing
B
mcpm
MCP security guard + package manager: trust-scored installs, blocks prompt injection and rug-pulls.
not reviewed
Growing
B
MCP
Authorize consequential AI agent actions before execution
not reviewed
Established
A
Projectmem
Coding agent memory — one local MCP server for every project. Warns before repeating failed fixes.
not reviewed
Growing
A
Lockstep
Decision memory for AI coding agents: captures decisions once, briefs every agent before it acts.
not reviewed
Growing
A

Local package. It runs on your machine, not through the gateway.

PKGTRUTH_REGISTRYAlternate npm registry to verify against. Defaults to https://registry.npmjs.org.
PKGTRUTH_DOWNLOADS_APIAlternate downloads API used for adoption figures. Defaults to https://api.npmjs.org.
PKGTRUTH_CACHE_DIRWhere adoption figures are cached between runs. Defaults to ~/.cache/pkgtruth.
PKGTRUTH_TIMEOUT_MSPer-request timeout in milliseconds. Defaults to 8000.

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/hxckya-pkgtruth.svg)](https://mcp.market/server/hxckya-pkgtruth)