Typosquat runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 30 Oct 2026.
Check dependency names against popular package names at small edit distance.
Today is the operative word: we check Typosquat every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add typosquat -- npx -y @reneturcios/typosquat
{
"mcpServers": {
"typosquat": {
"command": "npx",
"args": [
"-y",
"@reneturcios/typosquat"
]
}
}
}
[mcp_servers.typosquat]
command = "npx"
args = ["-y", "@reneturcios/typosquat"]
{
"mcpServers": {
"typosquat": {
"command": "npx",
"args": [
"-y",
"@reneturcios/typosquat"
]
}
}
}
{
"servers": {
"typosquat": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@reneturcios/typosquat"
]
}
}
}
Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.
Check an npm package name shape. Name discarded.
README drift auditor: documented names and flags checked against the actual package.
Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.
Ranks open-source projects on maintenance, not popularity. Check your dependencies.
Checks declared npm/PyPI dependencies against real registries to catch slopsquatting
Checks declared npm/PyPI dependencies against real registries to catch slopsquatting
Dependency policy and MCP server to stop AI coding agents from installing risky npm packages.
Answers built from our own checks of this server.