pkg-oracle — Dependency Trust Oracle MCP Server

by julian-martin89

answering

pkg-oracle — Dependency Trust Oracle is answering right now. Last checked 16 min ago. It exposes 1 tools.

Pay-per-call dependency trust oracle: verifies npm/PyPI packages before an AI agent installs them.

Uptime history 13 hours of history

13 hours agonow

100.0%

Uptime 24h

47 of 47 checks

Tools

read from the server

222 ms

Response time

average over 24h

open, no key

Access

streamable-http

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 16 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add pkg-oracle --transport http https://mcp-snowy-dew-9447.fly.dev/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "pkg-oracle": {
      "url": "https://mcp-snowy-dew-9447.fly.dev/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.pkg-oracle]
url = "https://mcp-snowy-dew-9447.fly.dev/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "pkg-oracle": {
      "url": "https://mcp-snowy-dew-9447.fly.dev/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "pkg-oracle": {
      "url": "https://mcp-snowy-dew-9447.fly.dev/mcp"
    }
  }
}

Available tools 1

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

verify

verify_package

Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.

Endpoints

URL	Transport	State	Latency	Checked
https://mcp-snowy-dew-9447.fly.dev/mcp	streamable-http	answering	317 ms	16 min ago

Alternatives to pkg-oracle — Dependency Trust Oracle

same job, measured the same way

Freshdeps MCP

by solvohq

Live npm/PyPI dependency-health verdicts so AI agents stop recommending stale or CVE'd packages

local only

Vdb

by ai-vdb

Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.

87 installs/wk local only

Jeevesus — DugganUSA Threat Intelligence MCP

by pduggusa

check-package: block malicious npm/PyPI deps before your AI agent installs them. Free, no key.

6 tools answering

Veragent

by lixiaowww

Check the trust/security score of MCP servers, agents, skills & CLIs before you install them.

75 installs/wk local only

Lazaretto

by jamesdfinance-dev

Verify a skill, tool, or package for malicious behavior before your agent installs it. Hosted.

4 tools answering

Closeread Verify

by freeguy-ai

A verified dependency-audit verdict any AI agent can call over MCP, not a raw scan.

122 installs/wk local only

AIMarket Oracle Gateway

by alexar76

Stdio MCP: 17 verifiable AIMarket oracles, 35 pay-per-call tools for AI agents.

430 installs/wk local only

Pulsefeed X402

by nikolife2016

Verify x402 payment endpoints before an AI agent pays: scam scan, on-chain checks, trust scores.

932 installs/wk 10 tools answering

pkg-oracle — Dependency Trust Oracle — questions

Answers built from our own checks of this server.

What can pkg-oracle — Dependency Trust Oracle do?

It exposes 1 tools, read directly from the server on our last check. Among them: verify_package. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is pkg-oracle — Dependency Trust Oracle working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 47 of 47 checks got a reply (100.0%), average response time 222 ms. The bar chart above shows every period we have measured.

How do I connect pkg-oracle — Dependency Trust Oracle?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does pkg-oracle — Dependency Trust Oracle need an API key?

No. pkg-oracle — Dependency Trust Oracle completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 1 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is pkg-oracle — Dependency Trust Oracle?

It answers our handshake in 222 ms on average, which is faster than 60% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.