MCP Server: io.github.julian-martin89/pkg-oracle

The io.github.julian-martin89/pkg-oracle Model Context Protocol (MCP) server is a pay-per-call dependency trust oracle. It verifies npm and PyPI packages before an AI agent installs them, using the server’s description to ensure package trust checks occur as part of the install workflow.

🛠️ Key Features

Verifies npm packages
Verifies PyPI packages
Uses a pay-per-call model for dependency trust checks
Purpose: dependency trust verification prior to AI-agent installation

🚀 Use Cases

Pre-install validation of dependencies from npm
Pre-install validation of dependencies from PyPI
AI agent workflows that require trusted package installation

⚡ Developer Benefits

Centralizes dependency trust verification for npm/PyPI installs
Enforces a “verify before install” dependency gate for AI agents

⚠️ Limitations

Available trust verification scope is limited to npm and PyPI package sources

verify_package

Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session.

Parameters3

ecosystem	string	required	Package registry to check the name against.
name	string	required	Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages).
version	string	optional	Optional exact version string to verify (e.g. "4.17.21"). Omit to check only the package name.

Raw schema

{
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "enum": [
        "npm",
        "pypi"
      ],
      "description": "Package registry to check the name against."
    },
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 214,
      "description": "Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages)."
    },
    "version": {
      "type": "string",
      "minLength": 1,
      "maxLength": 100,
      "description": "Optional exact version string to verify (e.g. \"4.17.21\"). Omit to check only the package name."
    }
  },
  "required": [
    "ecosystem",
    "name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

pkg-oracle — Dependency Trust Oracle

MCP Server: io.github.julian-martin89/pkg-oracle

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

verify_package

Install

Remote endpoint