Pkgtruth MCP server

pkgtruth

Ground truth about npm and PyPI packages, for AI coding agents and CI.

Your agent just wrote npm install unused-imports. That package is not the linter plugin it meant. It is a name an attacker registered because models kept inventing it — and npm has since replaced it with a security placeholder.

pkgtruth catches that before it reaches your lockfile — as an MCP server the agent asks, a CLI for CI, a GitHub Action on pull requests, or a Claude Code hook that denies the install command itself.

Why this exists

Large language models invent package names. Measured across models, 19.7% of generated package names were hallucinated, and when researchers re-ran the prompts, 43% of those names came back every single time.

That reproducibility is the whole attack. An attacker does not need to compromise a maintainer, poison a build server, or find a vulnerability. They watch what models invent, register the name, and wait. The technique is called slopsquatting, and it is already happening in the wild.

The standing security advice is that agents with package-management capabilities should not install anything without a review gate. pkgtruth is that gate, in a form an agent can call on its own.

Found in the wild

Two names a model plausibly produces, both live on npm today:

types-node is what you get when a model drops the scope from @types/node. npm removed it for malicious code in December 2024 and it is still installed ten times a week.

socket-io is not malicious — it is an abandoned package with a confusable name. That it takes 1,486 installs a week anyway is the point: a dot and a hyphen are enough.

PyPI has the same shape without the placeholder:

Neither is spelled anything like the package it stands in for, which is why pkgtruth also reads what a deprecation notice says: when it names a far more popular package, that name is the evidence.

npx pkgtruth check types-node socket-io
npx pkgtruth check -e pypi sklearn pytorch

Those two came from a hand check of twenty names. The systematic version — 242 well-known packages, every plausible garbling of each, regenerated every Monday — lives in SLOPSQUATS.md. Section A there is npm security placeholders alone: names npm purged for malware that are still being installed this week. Weeks in which names enter or leave the list are published as releases, so the releases feed is a way to follow the live list without watching the repository.

Install

As an MCP server (for coding agents)

{
  "mcpServers": {
    "pkgtruth": {
      "command": "npx",
      "args": ["-y", "pkgtruth"]
    }
  }
}

Three tools become available:

Shortened. The full README is on GitHub.