MCP server

Pkgtruth

io.github.hxckya/pkgtruth

Checked 25 Oct 2026, 21:11 UTC · Still published on its registry; checked against OSV.dev; never run by us

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Runs on your computer

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code

Last checked

25 Oct 2026, 21:11 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. It then runs the package on your computer with your permissions. For other apps, copy the setup below.

Claude Code

claude mcp add pkgtruth -- npx -y pkgtruth@0.2.2

Claude Desktop

{"mcpServers":{"pkgtruth":{"command":"npx","args":["-y","pkgtruth@0.2.2"]}}}

Codex (config.toml)

[mcp_servers.pkgtruth]
command = "npx"
args = ["-y","pkgtruth@0.2.2"]

Gemini CLI

{"mcpServers":{"pkgtruth":{"command":"npx","args":["-y","pkgtruth@0.2.2"]}}}

Cursor

{"mcpServers":{"pkgtruth":{"command":"npx","args":["-y","pkgtruth@0.2.2"]}}}

VS Code

{"servers":{"pkgtruth":{"type":"stdio","command":"npx","args":["-y","pkgtruth@0.2.2"]}}}

Runs on your computer with your permissions: check the package and its source before installing.

Browse

• GitHub tools
• GitHub and code hosting

Related MCP servers

• Krabbot Devtools
  AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.
• Ai Vdb
  Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.
• PackageGuard
  x402-gated safety checker for npm/PyPI packages before you npm install / pip install.
• Jeevesus — DugganUSA threat-intel MCP
  Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.
• Stormap
  Brainstorm scored idea maps, check npm/PyPI packages and vendors, find the right paid API.
• Package Intel MCP
  Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
• Presend dependency checks
  Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.
• PG1 Sovereign Threat Intelligence
  Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.hxckya/pkgtruth.svg)](https://aptlynx.net/servers/io.github.hxckya/pkgtruth)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents