pkgtruth

io.github.hxckya/pkgtruth · v0.2.2

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

Description supplied by the publisher in the MCP Registry. We have not tested this server.

Install

npx -y pkgtruth

Assembled from the package metadata in the official MCP Registry (including any subcommand or flag the publisher lists). Some publishers do not list the subcommand that starts MCP mode, so confirm the command in the README, along with any required configuration and credentials, before connecting it to real data.

Signals

GitHub stars	4
npm weekly downloads	61
Last push	4d ago
Licence	MIT
Open issues	0
SECURITY.md	Yes
Language	JavaScript
Latest version published	2026-09-10

Signals captured from GitHub, npm and the official MCP Registry on October 15, 2026. See the scoring method.

Similar servers

SkillTotal

Score 80

Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.

★ 12Apache-2.0pushed 3d ago

SecurityAI & media

SUNGLASSES

Score 80

Input firewall for AI agents: scan text and files before an agent reads them. Local, no network.

★ 10MITpushed 3d ago

SecurityAI & media

agent-security-scanner-mcp

Score 92

Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.

★ 124↓ 327/wkMITpushed 2d ago

Security