Skip to main content
Glama
jahija-okan

pkgproof

by jahija-okan

Verify package

verify_package

Verify an npm package before install. Runs eight checks on advisories, install scripts, typosquatting, provenance, and maintainer reputation, returning safe, caution, block, or does_not_exist.

Instructions

Verify an npm package before installing it. Runs eight checks covering advisories, install scripts, typosquat and combosquat names, scope, repository provenance and maintainer reputation, and answers safe, caution, block or does_not_exist with every reason labelled as fact or heuristic against its source. One call is one verification: the first each day is free, and later ones cost $0.05 in USDC when a wallet is configured.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name, scoped or not: left-pad, @scope/thing.
versionNoExact version to verify. Omit to verify the package rather than one release.
ecosystemNoPackage ecosystem. Only npm is supported.npm

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYes
reasonsYesEvery reason behind the verdict.
sourcesYesThe datasets consulted, by name and URL.
verdictYes
versionYesThe version verified, or null if none was given.
ecosystemYes
checked_atYesWhen the verdict was computed, ISO 8601 UTC.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv0.1.0

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes the eight check areas, the verdicts returned, and that each reason is labelled as fact or heuristic with a source. It also discloses the paid nature and one-verification-per-call behavior, consistent with the annotations indicating non-read-only and non-idempotent behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every clause carries useful information: purpose, checks, verdicts, labelling, and cost. There is no filler or vague wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers what the tool does, what it returns, and the operational constraints (cost, one call per verification, daily free limit). It is self-contained for an agent to decide when and how to invoke it, especially with the output schema available.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides detailed parameter descriptions, and the tool description reinforces them by mentioning scoped names, optional version omission, and npm-only ecosystem support. Parameter meaning is fully unambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool's purpose: verifying an npm package before installation, and enumerates the check categories and verdict types. It is specific about the resource and behavior, leaving no ambiguity even without sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises use before installing a package and clarifies that one call verifies one package. It also provides operational details such as the daily free call and subsequent cost, making usage boundaries clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jahija-okan/pkgproof-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server