Connect-MCP

pkg-oracle — Dependency Trust Oracle

io.github.julian-martin89/pkg-oracle · v1.0.1

Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.

MCPremoteno credentialsDeveloper tools

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 1 tools, protocol 2025-06-18 · checked 2026-10-17

Test & rating

B 83/100

What it does: 1 tool · 1 read, 0 write · Finance, Security

No tool could be tested safely. Only read-only tools that need no input are called.

How the rating is made
  • Answers without login: +30
  • Speed of first answer: +10
  • Lists tools: +10
  • Tool descriptions: +15
  • Parameter descriptions: +10
  • Read/write annotations: 0
  • Safe test call: +8
  • More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL
https://mcp-snowy-dew-9447.fly.dev/mcp

Tools

1 tools listed at last check
  • verify_package Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, Cargo.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev,

Badge

Connect-MCP badge for io.github.julian-martin89/pkg-oracle

Markdown for your README
[![Connect-MCP](https://clawy.uk/mcp/badge/io.github.julian-martin89/pkg-oracle.svg)](https://clawy.uk/mcp/s/io.github.julian-martin89/pkg-oracle)