"PyPI" matching MCP servers:

AgentAvow scans any MCP server, package (npm/PyPI/crates/Docker/Hugging Face), or GitHub repo and returns a signed, offline-recomputable 0–100 trust score with a plain safe / needs-review verdict. Authless and read-only, no account.

Enables coding agents to query package release histories, version lists, and change summaries across PyPI, npm, crates.io, Packagist, NuGet, pub.dev, Go, and Maven Central to inform dependency upgrades and detect withdrawn versions.

Connect any MCP-compatible AI assistant to your Pentest-Tools.com account to run scans, triage findings, and generate reports.

MCP server (stdio, MIT) with five tools that run locally with no API key: offline IBAN validation, disposable-email and MX check, DNS lookup with SPF and DMARC, ECB euro exchange rates, and package vulnerability lookup for npm and PyPI. A bridge in the same repo connects to the hosted Ambolt server with 37 tools, including company registry lookup, EU and UK tenders and Solana swap quotes.

A structured project memory MCP server that persists plans, builds, reviews, and decisions across AI coding sessions and tools, enabling continuous project management with a dashboard.

Deterministic supply-chain provenance, SBOM/AI-BOM generation, and dependency risk analysis for npm and PyPI packages, with 14 security rules and verifiable reports.

deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service to trust or configure.

Enables AI agents to vet npm and PyPI packages before installation, reporting typosquats, vulnerabilities in the selected version, publisher changes, and names that don't exist or were published within the last 30 days. It also exposes DNS, WHOIS, email, JWT and file/image utilities as tools over Streamable HTTP, with no signup or API key required.