MCP.Market

Package Risk MCP server

by makosdDavid·io.github.makosdDavid/package-risk·v1.0.5
No reviews yet

Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
New

0 stars64 downloads/wk

Reviews

Write one

Nobody has reviewed Package Risk yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Package Risk tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-11-03 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 81 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Package Risk compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,255 servers
Downloads a week
64
more than 51% of 12,191 servers with a package

Install Package Risk in Claude Code, Cursor or VS Code

Runs npx -y @makosdav/package-risk-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add package-risk -- npx -y @makosdav/package-risk-mcp
Add to Cursor

What the publisher says

From the Package Risk repository's README, as published. We do not edit it. Read it on GitHub

package-risk MCP connector

MCP tools for checking a package's maintenance status, licence, and security advisories before you depend on it - packagerisk, packagelicence, package_advisories. Paid per call in USDC on Base mainnet via x402.

No subscription, no API key. You pay from your own wallet, per call, only for what you use.

What this is (and isn't)

This is a thin client. The actual service is a stateless HTTP API at x402-package-risk.x402-package-risk.workers.dev. This connector never sees, holds, or forwards anyone else's funds - it only ever spends the wallet key you configure below, and only when you call one of its tools.

Setup

You need an EVM wallet with a small amount of USDC on Base mainnet (calls cost $0.005-$0.01 each). Never use a wallet holding significant funds for an automated agent key - keep this one funded lightly.

Add to your MCP client config (Claude Desktop, Claude Code, Cursor, etc.):

{
  "mcpServers": {
    "package-risk": {
      "command": "npx",
      "args": ["-y", "@makosdav/package-risk-mcp"],
      "env": {
        "EVM_PRIVATE_KEY": "0xyour-private-key-here"
      }
    }
  }
}

Tools

All three take system (npm/pypi/go/maven/cargo/nuget), name, and an optional version.

How payment works

CDP, returns the result, and settles on-chain.

  1. Your agent calls a tool.
  2. This connector requests the resource; the server replies 402 Payment Required.
  3. @x402/fetch builds and signs a payment authorisation with your key.
  4. The request retries with payment attached; the server verifies via Coinbase

No approval prompt happens here beyond what your MCP client itself asks for - if you want per-call confirmation, configure that in your agent framework, not here.

Nothing above is checked by us. What we check is on the safety report.

Package Risk: common questions

Is Package Risk MCP server safe?
Mostly: it is graded B (78/100). Read the Package Risk safety report
How do I install Package Risk?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Package Risk need an API key?
Yes. The registry entry asks for EVM_PRIVATE_KEY.
Is Package Risk maintained?
The last commit was 82 days ago (2026-08-14). The latest release is v1.0.5.
How does Package Risk compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,255 servers); downloads a week 64 (more than 51% of 12,191 servers with a package). Full comparison.