ossfind MCP server

by Aniket-kr1030·io.github.Aniket-kr1030/ossfind·v0.1.12

Safety-ranked open-source component discovery for agents across six package ecosystems.

C55/100grade C

What users say

No reviews yet

Safety scan

C55/100

Adoption

New

92 downloads/wk

Reviews

Nobody has reviewed ossfind yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

check_compatibility
Compare a verified npm package manifest with package.json facts or a PyPI manifest with Python project facts. Cargo, RubyGems, GitHub, and Hugging Face components have no verified package API surface and return a structured unsupported response. Both supported ecosystems use verified SPDX license data; unknown facts remain explicit in the A3 report.
inspect_component
Return a verified npm TypeScript or PyPI Python API surface and integration manifest. Cargo, RubyGems, GitHub, and Hugging Face components have no verified API surface and return a structured unsupported response. Accepts a package name or matching npm:<name>/pypi:<name> search ID; exported symbols are capped and disclosure is explicit.
plan_integration
Return install commands, imports, and a signature-verified usage scaffold for an npm or PyPI component. Cargo, RubyGems, GitHub, and Hugging Face components have no verified API surface and return a structured unsupported response. Include matching project facts to attach an A3 compatibility report.
search_components
Discover, enrich, score, and rank components. detail defaults to compact selection facts; use full for the complete prior result shape.
usage_stats
Return in-memory aggregate usage metrics including supplier request counters, rate-limit headroom, cache hit rates, verdict distributions, and latency percentiles.

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

no findings

Code scan170 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancerepository not readable: repo not found3/15
Maintainer identityno repository or website to verify2/10

Overall 55/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y ossfind on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add ossfind -- npx -y ossfind

Is ossfind MCP server safe?: With care: it is graded C, so read the findings first (55/100). Read the ossfind safety report
How do I install ossfind?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does ossfind need an API key?: Yes. The registry entry asks for GITHUB_TOKEN, LIBRARY_IO_API_KEY.
Is ossfind maintained?: The latest release is v0.1.12.

Local package. It runs on your machine, not through the gateway.

GITHUB_TOKENsecretOptional. Raises the GitHub repository-search rate limit; discovery works without it.
LIBRARY_IO_API_KEYsecretOptional libraries.io key, used as the PyPI discovery fallback when no local index has been built. Without it, and without an index, PyPI search reports itself unavailable rather than returning nothing.
OSSFIND_FIXTURESSet to 1 to run fully offline against frozen supplier responses, for evaluation without network access.

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/aniket-kr1030-ossfind.svg)](https://mcp.market/server/aniket-kr1030-ossfind)