Verify an npm or PyPI package before install: advisories, install scripts, typosquats, repository.
Connect Runs on your machine
claude mcp add pkgproof -e PKGPROOF_ALGORAND_PRIVATE_KEY=<PKGPROOF_ALGORAND_PRIVATE_KEY> -e PKGPROOF_BASE_PRIVATE_KEY=<PKGPROOF_BASE_PRIVATE_KEY> -- npx -y @pkgproof/[email protected]{
"mcpServers": {
"pkgproof": {
"command": "npx",
"args": [
"-y",
"@pkgproof/[email protected]"
],
"env": {
"PKGPROOF_ALGORAND_PRIVATE_KEY": "<PKGPROOF_ALGORAND_PRIVATE_KEY>",
"PKGPROOF_BASE_PRIVATE_KEY": "<PKGPROOF_BASE_PRIVATE_KEY>"
}
}
}
}{
"mcpServers": {
"pkgproof": {
"command": "npx",
"args": [
"-y",
"@pkgproof/[email protected]"
],
"env": {
"PKGPROOF_ALGORAND_PRIVATE_KEY": "<PKGPROOF_ALGORAND_PRIVATE_KEY>",
"PKGPROOF_BASE_PRIVATE_KEY": "<PKGPROOF_BASE_PRIVATE_KEY>"
}
}
}
}{
"servers": {
"pkgproof": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@pkgproof/[email protected]"
],
"env": {
"PKGPROOF_ALGORAND_PRIVATE_KEY": "<PKGPROOF_ALGORAND_PRIVATE_KEY>",
"PKGPROOF_BASE_PRIVATE_KEY": "<PKGPROOF_BASE_PRIVATE_KEY>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
PKGPROOF_ALGORAND_PRIVATE_KEYOptional, secret | Base64 account key of a throwaway Algorand wallet holding USDC (ASA 31566704) on Algorand Mainnet. Not a 25-word mnemonic. Optional: the first verification each day is free without any key. This is the rail payments prefer. |
PKGPROOF_BASE_PRIVATE_KEYOptional, secret | 0x-prefixed private key of a throwaway EVM wallet holding USDC on Base. Optional, and only used when no Algorand key is configured. Needs no ETH: payment is an off-chain signature and the facilitator pays the gas. |
Details
| Package | @pkgproof/[email protected] (NPM, stdio) |
| First published | 15 Oct 2026 |
| Last updated | 15 Oct 2026 |
| Registry name | net.pkgproof/pkgproof |
More developer tools servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.