Skip to main content
Glama
arhancanli

package-truth

by arhancanli
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

Related Servers

Alternatives to package-truth

No user-submitted related servers found.

    Related Servers

    • pkgproof

      jahija-okan
      A
      license
      A
      quality
      B
      maintenance
      Verifies npm packages for security risks before installation, checking advisories, install scripts, typosquatting, and other factors, providing safe/block verdicts.
      1
      94 npm
      Apache 2.0

    • mcp-dependency-version

      Tripletex
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables users to look up package versions, scan for vulnerabilities, and analyze dependencies across multiple registries (npm, Maven, PyPI, etc.) using exact version recommendations for security.
      4
      MIT

    • pkgtruth

      hxckya
      A
      license
      A
      quality
      A
      maintenance
      Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.
      3
      48 npm
      4
      MIT

    • Dependency Health MCP

      ux-xd
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables checking whether software packages are deprecated, archived, stale, active, or unknown with supporting evidence, auditing dependency manifests, and looking up runtime support and end-of-life dates.
      MIT

    • pkg-oracle

      julian-martin89
      A
      license
      Not graded
      quality
      B
      maintenance
      An MCP server that verifies npm and PyPI packages before installation, checking for existence, known vulnerabilities, OpenSSF scorecard, and typosquatting, returning an ALLOW/WARN/BLOCK verdict.
      MIT

    • pkgguard

      kiansaeidnia
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI coding agents to automatically verify npm packages against the live registry before installation, flagging hallucinated, slopsquatted, or otherwise suspicious packages with risk verdicts.
      7 npm
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.2/5.0

    Scored across 3 tools

    Disambiguation4/5

    The three tools are clearly distinct: check_manifest validates dependency files, get_advisories provides detailed advisory info for a specific package version, and check_packages performs bulk registry checks. While both check_manifest and check_packages can surface advisories, their inputs and purposes differ (file text vs. registry list), so ambiguity is minimal.

    Naming Consistency5/5

    All tools follow a consistent verb_noun pattern with snake_case: check_manifest, get_advisories, check_packages. The verbs (check, get) are descriptive and the nouns (manifest, advisories, packages) clearly indicate the target.

    Tool Count5/5

    Three tools is ideal for the server's focused purpose of package verification and security. Each tool serves a distinct need (manifest scanning, bulk checking, advisory lookup) without unnecessary overlap or bloat.

    Completeness5/5

    The server covers the core domain comprehensively: manifest validation, bulk package checks (existence, latest, deprecated, advisories, license, age), and detailed advisory queries. For a read-only package truth service, there are no obvious missing operations or dead ends.

    Resources