@pkgproof/mcp

What changed

Changed 2026-10-16 11:35 UTC

1 description rewritten.

--- pinned/verify_package
+++ observed/verify_package
  {
    "annotations": {
      "destructiveHint": false,
-   "description": "Verify an npm package before installing it. Runs nine checks covering advisories, install scripts, typosquat and combosquat names, scope and declared-repository checks, and how the release differs from its predecessors, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.",
+   "description": "Verify an npm or PyPI package before installing it. Runs up to nine checks covering advisories, install scripts, typosquat and combosquat names, scope and declared-repository checks, and how the release differs from its predecessors, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "properties": {
-         "description": "Package ecosystem. Only npm is supported.",
+         "description": "Package ecosystem: npm or pypi.",
          "enum": [
-           "npm"
+           "npm",
+           "pypi"
          ],
          "type": "string"
        },
-         "description": "Package name, scoped or not: left-pad, @scope/thing.",
+         "description": "Package name: left-pad or @scope/thing on npm, requests on PyPI.",
          "minLength": 1,
          "type": "string"
        },

Changed 2026-10-15 11:34 UTC

1 description rewritten.

--- pinned/verify_package
+++ observed/verify_package
  {
    "annotations": {
      "destructiveHint": false,
-   "description": "Verify an npm package before installing it. Runs eight checks covering advisories, install scripts, typosquat and combosquat names, scope and declared-repository checks, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.",
+   "description": "Verify an npm package before installing it. Runs nine checks covering advisories, install scripts, typosquat and combosquat names, scope and declared-repository checks, and how the release differs from its predecessors, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "properties": {
+       "dist_tag": {
+         "description": "The dist-tag a version-less request resolved through; null when a version was given.",
+         "type": [
+           "string",
+           "null"
+         ]
+       },
        "ecosystem": {
          "type": "string"
        },
+       "resolved_version": {
+         "description": "The release the checks ran against: the version asked for, or the registry's latest.",
+         "type": [
+           "string",
+           "null"
+         ]
+       },
        "sources": {
          "additionalProperties": {
            "type": "string"

Changed 2026-10-14 12:06 UTC

1 description rewritten.

--- pinned/verify_package
+++ observed/verify_package
  {
    "annotations": {
      "destructiveHint": false,
-   "description": "Verify an npm package before installing it. Runs eight checks covering advisories, install scripts, typosquat and combosquat names, scope, repository provenance and maintainer reputation, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.",
+   "description": "Verify an npm package before installing it. Runs eight checks covering advisories, install scripts, typosquat and combosquat names, scope and declared-repository checks, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.",
    "inputSchema": {
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "properties": {

Current tools

Watch this server yourself

If you run this server, put the proxy in front of it. It pins these exact fingerprints on first connect and stops the session if they move.

npx -y mcp-pin@0.2.3 -- <your @pkgproof/mcp command>

Or subscribe to this page's RSS feed to be told when it changes.

Badge

The badge states one fact about time and nothing else. It never claims a server is safe.

[![mcp-pin](https://mcp-pin.gautamkhosla.com/badge/93e828c4e47e4d8d.svg)](https://mcp-pin.gautamkhosla.com/servers/93e828c4e47e4d8d.html)