mcpbeat Sign in

pkg-oracle — Dependency Trust Oracle MCP Server

by julian-martin89 Your server? Claim it
answering

pkg-oracle — Dependency Trust Oracle is answering right now. Last checked 7 min ago. It exposes 1 tools.

Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.

Uptime history 91 days of history · worst day 98%
91 days agonow
100.0%
Uptime 24h
91 of 91 checks
1
Tools
read from the server
204 ms
Response time
average over 24h
open, no key
Access
streamable-http

What changed 2

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 2 October 2026. No other catalogue keeps this.

2 Oct a tool description was rewritten verify_package
2 Oct a tool changed the parameters it asks for verify_package

Nothing serious here today

Today is the operative word: we check pkg-oracle — Dependency Trust Oracle every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 7 min ago.

run in your terminal
claude mcp add pkg-oracle --transport http https://mcp-snowy-dew-9447.fly.dev/mcp
Settings → Connectors → Add custom connector, then paste this address
https://mcp-snowy-dew-9447.fly.dev/mcp
~/.codex/config.toml
[mcp_servers.pkg-oracle]
url = "https://mcp-snowy-dew-9447.fly.dev/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "pkg-oracle": {
      "url": "https://mcp-snowy-dew-9447.fly.dev/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "pkg-oracle": {
      "type": "http",
      "url": "https://mcp-snowy-dew-9447.fly.dev/mcp"
    }
  }
}

Available tools 1

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

verify
verify_package
Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, Cargo.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.

Endpoints

URLTransportStateLatencyChecked
https://mcp-snowy-dew-9447.fly.dev/mcp streamable-http answering 187 ms 7 min ago

Alternatives to pkg-oracle — Dependency Trust Oracle

same job, measured the same way
Pkgtruth
by hxckya

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

69 installs/wk local only
Presend dependency checks
by presendapp

Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.

5 tools answering
lurq
by jadenryu

Verify npm packages before your AI agent installs them: hallucinations, advisories, API drift.

16 tools answering
Presend MCP Server
by presendapp

Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.

40 tools answering
Attestari
by attestari

Attestari's verdict on an npm or PyPI package version, asked before an agent installs it.

281 installs/wk answering
pkgproof
by pkgproof

Verify an npm or PyPI package before install: advisories, install scripts, typosquats, repository.

73 installs/wk local only
U
url-oracle — URL Trust Oracle
by julian-martin89

Flags phantom-squatted/typosquatted domains and known-malicious URLs before an agent follows them.

1 tools answering
Vdb
by ai-vdb

Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.

215 installs/wk 7 tools answering

pkg-oracle — Dependency Trust Oracle — questions

Answers built from our own checks of this server.

What can pkg-oracle — Dependency Trust Oracle do?
It exposes 1 tools, read directly from the server on our last check. Among them: verify_package. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is pkg-oracle — Dependency Trust Oracle working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 204 ms. The bar chart above shows every period we have measured.
How do I connect pkg-oracle — Dependency Trust Oracle?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does pkg-oracle — Dependency Trust Oracle need an API key?
No. pkg-oracle — Dependency Trust Oracle completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 1 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is pkg-oracle — Dependency Trust Oracle?
It answers our handshake in 204 ms on average, which is faster than 67% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.