A
licenseNot graded
qualityA
maintenanceEnables MCP-compatible AI applications to perform read-only npm package and project dependency safety scans, returning proceed, caution, or block verdicts without executing package code.
45 npm
MIT
KarmaDue
by ashadow07
Provides pre-install checks for npm packages: agents can call check_install with ecosystem "npm" (or the karmadue-guard shim can intercept npm/npx installs) to get a verdict on a target package—a known trap with tested fix steps (fix_first), a warn, a deny for a malicious-package report, no_known_issues, or unknown—along with dated test records and supporting fix recipes.
Provides pre-install checks for pnpm installs via the karmadue-guard shell shim, which wraps pnpm so that a package is evaluated against known install traps and malicious-package reports before it is installed, returning tested fix steps or a warn/deny/no_known_issues/unknown verdict.
Provides pre-install checks for yarn installs via the karmadue-guard shell shim, which wraps yarn so that a package is evaluated against known install traps and malicious-package reports before it is installed, returning tested fix steps or a warn/deny/no_known_issues/unknown verdict.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@KarmaDuebefore I install tailwindcss@4 with npm, check for known traps"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
KarmaDue
A pre-install check for AI agents. Before your agent runs npm install, pip install, uv add, npx/uvx, or adds an MCP server, it calls check_install and gets one answer: a known trap with tested fix steps (fix_first), a warn, a deny for a malicious-package report, no_known_issues, or unknown (no evidence; not safety clearance).
Read-only. Nothing runs your command.
No account or key for reads. Anonymous limit: 30 requests/hour per IP.
Every fix cites a dated test record. Seed records are labeled "Founder-operated assessment, not independent".
Honest limits: lockfile installs (
npm ci,pip install -r) and transitive dependencies are not covered.
Try it (no account)
curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_install","arguments":{"target":"tailwindcss@4","ecosystem":"npm","runtime_env":"node 20 linux"}}}'Related MCP server: pkgguard
MCP server
Endpoint (Streamable HTTP) | Auth | Tools |
| none for reads |
|
| OAuth 2.1 (Claude, ChatGPT) | same, plus |
| OAuth 2.1 mirror (strict clients) | same as connector |
Claude Code: claude mcp add --transport http karmadue https://karmadue--mcp.expo.app/mcp
What is in this repository
Path | What |
| |
Claude Code PreToolUse hook ( | |
The agent docs as published at https://karmadue.expo.app/docs/ (quick start, tools, permissions, security, changelog) | |
The published seed records (tested install traps and fixes), snapshot of https://karmadue.expo.app/docs/seed-records.json |
The server and database are hosted and are not part of this repository.
Links
Quick start: https://karmadue.expo.app/docs/mcp.md
Official MCP Registry name:
io.github.ashadow07/karmadue
License
MIT, see LICENSE. Seed records describe third-party packages and are provided as dated observations, not guarantees.
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues
Related MCP Connectors
Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.
Verify npm packages before your AI agent installs them: hallucinations, advisories, API drift.
Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables AI coding agents to automatically verify npm packages against the live registry before installation, flagging hallucinated, slopsquatted, or otherwise suspicious packages with risk verdicts.3 npmMIT
- AlicenseAqualityAmaintenanceEnables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.323 npm4MIT
- AlicenseAqualityBmaintenanceEnables checking packages across npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems for existence, deprecation, known vulnerabilities, and license issues before installation, providing verdicts like does_not_exist, risky, verify, or ok.31MIT