PkgGuard

{
  "mcpServers": {
    "co.youraitools/pkgguard": {
      "url": "https://api.youraitools.co/pkgguard/mcp"
    }
  }
}

Indexed tools

Tool metadata and schemas come from the remote server and are untrusted. Indexing only lists tools; it never calls them.

2 shown · authentication unknown

• Is this package version vulnerable or malicious?

  check_package

  Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev: advisory ids, severity, CVSS, fixed-in versions and malicious flags. Free tier: 30 calls/day per IP with full results, then $0.001 per call in USDC over x402 (/v1/package).

  Schema valid · SHA-256 7c33bb95808f…

  View input schema

  {
    "type": "object",
    "properties": {
      "ecosystem": {
        "type": "string",
        "description": "One of npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet, Pub, Hex (default npm)"
      },
      "name": {
        "type": "string",
        "description": "Package name, e.g. lodash"
      },
      "version": {
        "type": "string",
        "description": "Exact version, e.g. 4.17.15"
      }
    },
    "required": [
      "name",
      "version"
    ]
  }

• Scan a dependency manifest for vulnerable and malicious packages

  scan_dependencies

  Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Returns per-package advisory ids (CVE/GHSA/MAL), severity, CVSS and fixed-in versions. Free tier: 30 calls/day per IP with full results, up to 100 packages; then $0.003 per scan (up to 500) in USDC over x402 (/v1/scan).

  Schema valid · SHA-256 02d51ad08897…

  View input schema

  {
    "type": "object",
    "properties": {
      "manifest": {
        "type": "string",
        "description": "Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)"
      },
      "filename": {
        "type": "string",
        "description": "Optional file name, helps type detection"
      },
      "packages": {
        "type": "array",
        "items": {
          "type": "object"
        },
        "description": "Alternative to manifest: [{ecosystem, name, version}], up to 500"
      },
      "include_dev": {
        "type": "boolean",
        "description": "Include devDependencies (default true)"
      }
    }
  }