Skip to main content
Glama
Sign In

PkgGuard

by co.youraitools
OverviewDiscussionsAdmin

Server Details

Dependency scan for agents: known CVEs and malicious packages via OSV.dev. By Crypto Money Maker

Ownership verified
Status
Healthy
Uptime
100.0% over the last 24 hours
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
ChatGPT
–
Claude
–

TDQS

A4.1/5.0

Scored across 2 tools

Disambiguation5/5

check_package handles a single package version while scan_dependencies handles manifests/lockfiles or package lists, giving each tool a clearly distinct scope. An agent can easily choose based on input granularity.

Naming Consistency5/5

Both names follow a consistent verb_noun snake_case pattern (check_package, scan_dependencies). The only slight variance is 'check' vs 'scan', but that reinforces the single vs batch distinction.

Tool Count3/5

Two tools is thin for a server surface, even if the domain is narrow vulnerability lookup. A single-package checker plus batch scanner covers the core use case, but there is little room for supporting operations.

Completeness4/5

Single and bulk vulnerability checks are covered, which is the main workflow. Minor gaps exist—no advisory lookup by CVE/GHSA ID, no supported-ecosystem listing, and no health/status tool—but agents can work around these.

Available Tools

2 tools
check_packageIs this package version vulnerable or malicious?A
Read-onlyIdempotent
Inspect

Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev: advisory ids, severity, CVSS, fixed-in versions and malicious flags. Free tier: 30 calls/day per IP with full results, then $0.001 per call in USDC over x402 (/v1/package).

Inputs: name (required), version (required), ecosystem.

scan_dependenciesScan a dependency manifest for vulnerable and malicious packagesA
Read-onlyIdempotent
Inspect

Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Returns per-package advisory ids (CVE/GHSA/MAL), severity, CVSS and fixed-in versions. Free tier: 30 calls/day per IP with full results, up to 100 packages; then $0.003 per scan (up to 500) in USDC over x402 (/v1/scan).

Inputs: filename, manifest, packages, include_dev.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Connectors

    Related MCP Servers

    • OSV Dependency Vulnerability

      fairquery
      A
      license
      A
      quality
      A
      maintenance
      Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.
      3
      MIT

    • Security Intel MCP

      datakoot
      A
      license
      A
      quality
      B
      maintenance
      Vulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.
      5
      MIT
    Try in Browser
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    Glama MCP Gateway

    Add one secure layer between your agents and this server.

    Resources