Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.
Connect Runs on your machine
claude mcp add pkgtruth -e PKGTRUTH_REGISTRY=<PKGTRUTH_REGISTRY> -e PKGTRUTH_DOWNLOADS_API=<PKGTRUTH_DOWNLOADS_API> -e PKGTRUTH_CACHE_DIR=<PKGTRUTH_CACHE_DIR> -e PKGTRUTH_TIMEOUT_MS=<PKGTRUTH_TIMEOUT_MS> -- npx -y [email protected]{
"mcpServers": {
"pkgtruth": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"PKGTRUTH_REGISTRY": "<PKGTRUTH_REGISTRY>",
"PKGTRUTH_DOWNLOADS_API": "<PKGTRUTH_DOWNLOADS_API>",
"PKGTRUTH_CACHE_DIR": "<PKGTRUTH_CACHE_DIR>",
"PKGTRUTH_TIMEOUT_MS": "<PKGTRUTH_TIMEOUT_MS>"
}
}
}
}{
"mcpServers": {
"pkgtruth": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"PKGTRUTH_REGISTRY": "<PKGTRUTH_REGISTRY>",
"PKGTRUTH_DOWNLOADS_API": "<PKGTRUTH_DOWNLOADS_API>",
"PKGTRUTH_CACHE_DIR": "<PKGTRUTH_CACHE_DIR>",
"PKGTRUTH_TIMEOUT_MS": "<PKGTRUTH_TIMEOUT_MS>"
}
}
}
}{
"servers": {
"pkgtruth": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"PKGTRUTH_REGISTRY": "<PKGTRUTH_REGISTRY>",
"PKGTRUTH_DOWNLOADS_API": "<PKGTRUTH_DOWNLOADS_API>",
"PKGTRUTH_CACHE_DIR": "<PKGTRUTH_CACHE_DIR>",
"PKGTRUTH_TIMEOUT_MS": "<PKGTRUTH_TIMEOUT_MS>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
PKGTRUTH_REGISTRYOptional | Alternate npm registry to verify against. Defaults to https://registry.npmjs.org. |
PKGTRUTH_DOWNLOADS_APIOptional | Alternate downloads API used for adoption figures. Defaults to https://api.npmjs.org. |
PKGTRUTH_CACHE_DIROptional | Where adoption figures are cached between runs. Defaults to ~/.cache/pkgtruth. |
PKGTRUTH_TIMEOUT_MSOptional | Per-request timeout in milliseconds. Defaults to 8000. |
Details
| Package | [email protected] (NPM, stdio) |
| First published | 10 Sep 2026 |
| Last updated | 10 Sep 2026 |
| Registry name | io.github.hxckya/pkgtruth |
More developer tools servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.