pkgtruth MCP

v0.2.2

io.github.hxckya/pkgtruth

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

transport:stdio runtime:npm

Target client

run in your project directory

claude mcp add pkgtruth -e PKGTRUTH_REGISTRY=<PKGTRUTH_REGISTRY> -e PKGTRUTH_DOWNLOADS_API=<PKGTRUTH_DOWNLOADS_API> -e PKGTRUTH_CACHE_DIR=<PKGTRUTH_CACHE_DIR> -e PKGTRUTH_TIMEOUT_MS=<PKGTRUTH_TIMEOUT_MS> -- npx -y pkgtruth

Adds it for this project only. Append --scope user to make it available everywhere. Claude Code docs

This listing does not declare its tools. Connect the server and your client will discover them on the handshake.

Secrets and scopes

The registry records which variables this server needs, not what privileges they must carry. Issue each one with the narrowest scope that works.

PKGTRUTH_REGISTRY
PKGTRUTH_DOWNLOADS_API
PKGTRUTH_CACHE_DIR
PKGTRUTH_TIMEOUT_MS

Runtime

Transport stdio

Registry npm

Package pkgtruth

Version 0.2.2

Provenance Official registry

Package managers

npx npm pnpm yarn bun Homebrew apt Chocolatey winget conda

npx -y pkgtruth

npm install -g pkgtruth

pnpm dlx pkgtruth

yarn dlx pkgtruth

bunx pkgtruth

Want a slot? Make an offer

Registry record

Repository https://github.com/hxckya/pkgtruth

Synced 17 h ago

JSON API /api/v0/servers/io.github.hxckya/pkgtruth