Presend dependency checks MCP server

• maintainer_change_checkFree

  Publisher-change analysis is npm only. Also reports whether the package exists (found) and its age (first_published, package_age_days, new_package if first published less than 30 days ago), for npm and for PyPI; on PyPI only existence and age are available. Flags a previously unseen human publisher taking over a package after 180+ days of inactivity, within the last 365 days (the event-stream attack pattern). npm trusted publishing (verified OIDC identity, not just a bot-like account name), pre-release, and handovers to a publisher who already maintains another widely used package (100k+ weekly downloads) are reported but not flagged. Does not detect hijacked existing accounts; a heuristic for review, not proof.

• repo_health_checkFree

  Maintenance signals for a GitHub repository given as owner/name: stars, forks, open issues, license, archived and fork flags, creation date and age, days since last push, topics. Use it to judge whether a dependency looks maintained or abandoned. For an npm or PyPI package whose repository you do not know, supply_chain_check resolves it from registry metadata and includes these signals. GitHub only; missing or private repositories return found: false.

• supply_chain_checkFree

  Call this before installing or adding a package (npm install, pip install, a new entry in a manifest), especially one whose name you recalled or that a model suggested. One-call risk check: combines vulnerability_check (OSV.dev), typosquat_check, maintainer_change_check (npm only) and repo_health_check (when the GitHub repo can be resolved) into one overall verdict. A package that does not exist on npm or PyPI gets overall_risk 'package_not_found': the name may be invented, do not install it. A package first published less than 30 days ago gets the 'new_package' flag and overall_risk 'review_recommended': new packages are where invented and look-alike names get registered, so confirm the name against the project's own documentation before installing (on PyPI the age is that of the oldest release still published; being new does not make a package malicious). Use the individual tools to investigate one signal. Vulnerabilities are checked for the given version, or the latest published one (version_checked, version_source). If a check could not run (rate limit, upstream error), it is listed in unavailable_checks and overall_risk is 'incomplete', never 'no_signals_found'.

• typosquat_checkFree

  Call before installing a package whose name you typed or recalled. Checks whether an npm or PyPI package name is a near-miss of a well-known package (typosquatting), with an edit-distance threshold scaled to name length; names of 3 characters or fewer are not fuzzy-matched. Uses a curated list of popular names, so a clean result does not prove a package is safe. It does not check that the package exists: supply_chain_check does.

• vulnerability_checkFree

  Checks a package (optionally a specific version) against OSV.dev for known vulnerabilities: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. Use cve_lookup when you already have a CVE/GHSA ID, or supply_chain_check for a combined verdict.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 292ms20/20
• Tool poisoning5 tool descriptions checked15/15
• Auth qualityopen endpoint, read-only tools10/15
• Maintenancelast push 0 days ago15/15
• Maintainer identityregistry namespace matches repository owner6/10

Safety score

88/100

higher than 80% of 4,460 AI and agents servers

Tools

5

the typical AI and agents server has 6

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote AI and agents server answers 100%

Response time

148 ms

faster than 77% of 2,331 AI and agents servers

Presend dependency checks: common questions

Is Presend dependency checks MCP server safe?

Yes, by our scan: it is graded A (88/100). Read the Presend dependency checks safety report

How do I install Presend dependency checks?

It runs remotely at presend.pages.dev. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Presend dependency checks need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Presend dependency checks maintained?

The last commit was 32 days ago (2026-10-03). The latest release is v1.0.0.

Is Presend dependency checks up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of Presend dependency checks?

Servers from other publishers that do the same job: Decionis MCP server, mcptoon MCP server and Mockserver MCP server.

How does Presend dependency checks compare with other AI and agents MCP servers?

safety score 88/100 (higher than 80% of 4,460 AI and agents servers); tools 5 (the typical AI and agents server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.