Package Risk runs on your own machine — the client starts it, so there is no endpoint to ping. 55 installs a week from npm. Last commit 14 Aug 2026.
Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.
Nothing serious here today
Today is the operative word: we check Package Risk every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add package-risk -e 'EVM_PRIVATE_KEY=<EVM_PRIVATE_KEY>' -- npx -y @makosdav/package-risk-mcp{
"mcpServers": {
"package-risk": {
"command": "npx",
"args": [
"-y",
"@makosdav/package-risk-mcp"
],
"env": {
"EVM_PRIVATE_KEY": "<EVM_PRIVATE_KEY>"
}
}
}
}[mcp_servers.package-risk]
command = "npx"
args = ["-y", "@makosdav/package-risk-mcp"]
env = { EVM_PRIVATE_KEY = "<EVM_PRIVATE_KEY>" }{
"mcpServers": {
"package-risk": {
"command": "npx",
"args": [
"-y",
"@makosdav/package-risk-mcp"
],
"env": {
"EVM_PRIVATE_KEY": "<EVM_PRIVATE_KEY>"
}
}
}
}{
"servers": {
"package-risk": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@makosdav/package-risk-mcp"
],
"env": {
"EVM_PRIVATE_KEY": "<EVM_PRIVATE_KEY>"
}
}
}
}Put your own value in place of
<EVM_PRIVATE_KEY> (Private key of an EVM wallet holding a small amount of USDC on Base mainnet. Each tool call spends $0.005-$0.01 from it. Use a lightly funded key dedicated to this agent, never a main wallet).
The author’s registry entry marks it as required.
Alternatives to Package Risk
same job, measured the same waySigned citation-integrity reports + retraction-checked evidence packs, paid per call via x402/USDC.
Signed x402 attestations and bounty-packet preflight checks, paid per call in USDC on Base.
Live Base Mainnet on-chain data (gas, DEX, Aave, token risk, prices). Pay per call in USDC via x402.
Base token safety checks (honeypot test, liquidity, new launches), paid per call in USDC via x402.
Vet a package (CVEs, license, maintenance) before your AI agent uses it, plus capability discovery.
Paid web research tools: cited briefs, quote checks, page text. Pay per call in USDC via x402.
X/Twitter reads, search, monitors and posting. Pay-per-call in USDC — no signup, no API keys.
Fixed-price maintenance for public GitHub issues, paid in USDC on Solana.
Package Risk — questions
Answers built from our own checks of this server.