Marketplace Trust Check
marketplace_checkRead-onlyIdempotent
Check package trust before installation by querying npm or PyPI registries and cross-referencing threat intelligence for CVEs and download stats.
Instructions
Pre-install trust check for an MCP server package.
Queries the package registry (npm or PyPI) for metadata and
cross-references against the agent-bom MCP threat intelligence registry.
Returns trust signals including download count, CVE status, and
registry verification.
Args:
package: Package name to check.
ecosystem: 'npm' or 'pypi'. Defaults to 'npm'.
Returns:
JSON with name, version, ecosystem, cve_count, download_count,
registry_verified, and trust_signals.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | Package name, e.g. 'express', 'langchain'. | |
| ecosystem | No | Package ecosystem: 'npm' or 'pypi'. | npm |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |