{"name":"io.github.presendapp/presend-deps","slug":"presendapp-presend-deps","title":"Presend dependency checks","description":"Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.","url":"https://mcp.market/server/presendapp-presend-deps","rating":null,"grade":"A","score":88,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":20,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-10-03T18:24:59.000Z","license":"MIT"},"uptime":{"percent":100,"checks":28,"ok":28,"last_checked_at":"2026-11-04T09:05:32.779Z","last_ok_at":"2026-11-04T09:05:32.779Z","latency_ms":148},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/presendapp/presend-source","website":null,"version":"1.0.0","remotes":[{"type":"streamable-http","url":"https://presend.pages.dev/mcp-deps"}],"packages":[],"tools":[{"name":"maintainer_change_check","description":"Publisher-change analysis is npm only. Also reports whether the package exists (found) and its age (first_published, package_age_days, new_package if first published less than 30 days ago), for npm and for PyPI; on PyPI only existence and age are available. Flags a previously unseen human publisher taking over a package after 180+ days of inactivity, within the last 365 days (the event-stream attack pattern). npm trusted publishing (verified OIDC identity, not just a bot-like account name), pre-release, and handovers to a publisher who already maintains another widely used package (100k+ weekly downloads) are reported but not flagged. Does not detect hijacked existing accounts; a heuristic for review, not proof.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ecosystem":{"type":"string","description":"npm (full analysis) or pypi (existence and age only)."},"package":{"type":"string","description":"Package name, e.g. lodash"}},"required":["ecosystem","package"]}},{"name":"repo_health_check","description":"Maintenance signals for a GitHub repository given as owner/name: stars, forks, open issues, license, archived and fork flags, creation date and age, days since last push, topics. Use it to judge whether a dependency looks maintained or abandoned. For an npm or PyPI package whose repository you do not know, supply_chain_check resolves it from registry metadata and includes these signals. GitHub only; missing or private repositories return found: false.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"repo":{"type":"string","description":"GitHub repository in owner/name format, e.g. lodash/lodash."}},"required":["repo"]}},{"name":"supply_chain_check","description":"Call this before installing or adding a package (npm install, pip install, a new entry in a manifest), especially one whose name you recalled or that a model suggested. One-call risk check: combines vulnerability_check (OSV.dev), typosquat_check, maintainer_change_check (npm only) and repo_health_check (when the GitHub repo can be resolved) into one overall verdict. A package that does not exist on npm or PyPI gets overall_risk 'package_not_found': the name may be invented, do not install it. A package first published less than 30 days ago gets the 'new_package' flag and overall_risk 'review_recommended': new packages are where invented and look-alike names get registered, so confirm the name against the project's own documentation before installing (on PyPI the age is that of the oldest release still published; being new does not make a package malicious). Use the individual tools to investigate one signal. Vulnerabilities are checked for the given version, or the latest published one (version_checked, version_source). If a check could not run (rate limit, upstream error), it is listed in unavailable_checks and overall_risk is 'incomplete', never 'no_signals_found'.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ecosystem":{"type":"string","description":"Package ecosystem, e.g. npm. maintainer-change-check only runs for npm."},"package":{"type":"string","description":"Package name to check."},"version":{"type":"string","description":"Exact version to check for known vulnerabilities. Optional: defaults to the latest published version (npm and PyPI)."}},"required":["ecosystem","package"]}},{"name":"typosquat_check","description":"Call before installing a package whose name you typed or recalled. Checks whether an npm or PyPI package name is a near-miss of a well-known package (typosquatting), with an edit-distance threshold scaled to name length; names of 3 characters or fewer are not fuzzy-matched. Uses a curated list of popular names, so a clean result does not prove a package is safe. It does not check that the package exists: supply_chain_check does.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ecosystem":{"type":"string","description":"Package ecosystem, e.g. npm or PyPI."},"package":{"type":"string","description":"Package name to check for likely typosquatting of a well-known package in the given ecosystem."}},"required":["ecosystem","package"]}},{"name":"vulnerability_check","description":"Checks a package (optionally a specific version) against OSV.dev for known vulnerabilities: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. Use cve_lookup when you already have a CVE/GHSA ID, or supply_chain_check for a combined verdict.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ecosystem":{"type":"string","description":"Package ecosystem, e.g. npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, or NuGet."},"package":{"type":"string","description":"Package name to check against OSV.dev for known CVEs."},"version":{"type":"string","description":"Omit to check all versions of the package."}},"required":["ecosystem","package"]}}],"scan":{"score":88,"grade":"A","scanned_at":"2026-10-03T21:43:05.782Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-03T21:43:05.739Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 292ms"]},"poisoning":{"score":15,"max":15,"notes":["5 tool descriptions checked"]},"auth":{"score":10,"max":15,"notes":["open endpoint, read-only tools"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[],"inputs":{"probes":[{"url":"https://presend.pages.dev/mcp-deps","reachable":true,"authRequired":false,"latencyMs":292,"serverInfo":{"name":"presend-deps","version":"1.0.0"}}],"packages":[],"repo":{"found":true,"owner":"presendapp","repo":"presend-source","archived":false,"pushedAt":"2026-10-03T18:24:59Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/300177977?v=4","ownerCreatedAt":"2026-07-05T16:43:21Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/300177977?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-10-03T18:24:59.000Z","score":20}}}},"grade_history":[],"reviews":[]}