pkgtruth for Windsurf
io.github.hxckya/pkgtruth
Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.
client:Windsurf
transport:stdio
runtime:npm
Install pkgtruth in Windsurf
~/.codeium/windsurf/mcp_config.json · windows: %USERPROFILE%\.codeium\windsurf\mcp_config.json
{
"mcpServers": {
"pkgtruth": {
"command": "npx",
"args": [
"-y",
"pkgtruth"
],
"env": {
"PKGTRUTH_REGISTRY": "<PKGTRUTH_REGISTRY>",
"PKGTRUTH_DOWNLOADS_API": "<PKGTRUTH_DOWNLOADS_API>",
"PKGTRUTH_CACHE_DIR": "<PKGTRUTH_CACHE_DIR>",
"PKGTRUTH_TIMEOUT_MS": "<PKGTRUTH_TIMEOUT_MS>"
}
}
}
}Global only — Windsurf has no per-project MCP config. Refresh Cascade after saving. Windsurf docs