Skip to main content
Glama
Baneado98

brandguard

by Baneado98
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

brandguard šŸ›”ļø

Brand impersonation & typosquat monitor for AI agents and brand owners.

Feed brandguard a brand or product name and it scans npm, PyPI and GitHub for packages and repos that typosquat or impersonate you ā€” each risk-scored ā€” plus a ready-to-review takedown / trademark-notice draft.

brandguard reports from public sources. It does not file claims on anyone's behalf and is not a law firm or your agent. The takedown notice is a draft for the rights-holder to review, complete and file themselves.

Live: https://brandguard.djrorrok.workers.dev

Why an agent can't do this alone (the moat)

An LLM coding/brand agent, on its own, doesn't know:

  • the typosquat surface of a name (omissions, doubling, homoglyphs oā†’0 lā†’1, deceptive -js/-sdk/-official affixes);

  • which listings across three registries actually exist right now;

  • how to separate the real brand / legit integrations (own npm scope, high adoption, third-party org scopes like @types/*) from parked squats ā€” without crying wolf.

brandguard does the cross-registry lookups and the calibrated scoring so the verdict is trustworthy: LIKELY_ABUSE is only raised with a signal beyond the name match (a "this is the official X" claim, or a parked-squat download pattern). Bare name matches are SUSPECT ā†’ human review, never a false accusation.

Related MCP server: pkgtruth

Use it

Free HTTP API

GET /scan?brand=acme&official=acme-inc        # top 5 findings, risk-scored (npm + PyPI)

MCP (over HTTP)

POST /mcp ā€” tools: scan_brand, draft_takedown.

Pay-per-call (x402) ā€” full scan + takedown drafts

GET /pro/scan?brand=acme&official=acme-inc    # 402 -> pay $0.15 USDC (Base) -> full report + drafts

Settles in USDC on Base via x402. No sign-up, no API key.

Sources (all public / ToS-compliant)

  • npm public registry search + downloads API

  • PyPI JSON API

  • GitHub Search API (server-side token)

Develop / deploy

node src/test.mjs            # unit + live tests
npx wrangler deploy          # Cloudflare Worker

MIT. Not legal advice.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • pkgtruth

    hxckya
    A
    license
    A
    quality
    A
    maintenance
    Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.
    3
    27 npm
    4
    MIT

  • npm-supply-chain-audit-mcp

    tylerscomic-lab
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables auditing package.json files for real npm supply-chain attack mechanisms ā€” typosquatted dependency names, malicious preinstall/install/postinstall scripts that pipe downloads into a shell or decode base64 payloads, and unpinned versions ā€” plus live npm registry lookups that flag nonexistent, brand-new, deprecated, or typosquatted packages. It exposes dedicated tools for full manifest audits and single-name typosquat checks.
    MIT

  • pkgverdict

    CloudCorpRecords
    A
    license
    Not graded
    quality
    A
    maintenance
    Enables developers and AI coding agents to vet npm packages before installation by checking existence, lookalike names, package age, install scripts, maintainers, downloads, and advisories, returning GO, RISKY, FAKE, or MISSING. It also scans a project's package.json for worst-first dependency verdicts and can run as a CLI or stdio MCP server.
    MIT