MCP.Market

pkg MCP server

by tneemo·io.github.tneemo/pkg·v0.1.0
No reviews yet

Find, install and assemble reusable software builds for coding agents.

A85/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A85/100

full report

Adoption
Growing

0 stars48 downloads/wk

Reviews

Write one

Nobody has reviewed pkg yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

pkg tools (8, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • detect_stack

    Show the stack pkg detects in a project directory (languages, frameworks, package managers, installed builds).

  • get_build

    Details of one build: README, integration notes, files, dependencies, environment variables and automated check results.

  • install_builds

    Install one or more builds into a project: resolves build dependencies, checks stack compatibility, verifies integrity, copies files, merges dependencies/scripts/.env.example, runs the package manager and writes pkg.lock.json. Never executes code from builds. Returns integration notes to follow next.

  • publish_buildwrite action

    Publish a folder as a reusable build so other agents don't have to rebuild it. Creates pkg.json if missing (review it), runs the automated checks, and publishes under the user's GitHub login. Only publish when the user asks to.

  • remove_buildswrite action

    Remove installed builds from a project: deletes the files each one installed unless they were edited since (edited files are kept and listed), drops them from pkg.lock.json, and lists npm/pip packages no installed build needs any more without uninstalling them. Refuses while another installed build depends on one of them. Afterwards remove the code that used them and run the tests.

  • report_outcome

    Tell the registry whether an installed build worked after you integrated and tested it. This anonymous signal is how pkg ranks builds; please call it once per installed build. Use outcome 'report' only for harmful or malicious builds.

  • search_builds

    Search the pkg registry for reusable builds (project foundations and modules) before writing code from scratch. Results are ranked by relevance, compatibility with the project's stack, automated security checks and how well they worked for other agents.

  • update_buildswrite action

    Update builds installed in a project (pkg.lock.json) to their newest version within the installed major version, or the newest overall with latest=true. Verifies integrity like install_builds and replaces only files nobody edited since install; edited or deleted files are left untouched and reported as conflicts to merge by hand. Returns the new versions' integration notes.

Public scan report

scanner v0.1.10 · 2026-10-27 · same rubric, same numbers if you re-run it

1 medium
  • Code scan2 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 8 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/pkg.js: …ode, sch); const makeValidate = new Function(`${names_1.default.self}`, `${names_1.de…
Overall 85/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How pkg compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
85/100
higher than 70% of 48,255 servers
Tools
8
the typical server has 7
Tools that change things
38%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
48
more than 40% of 12,191 servers with a package

What its tools let an agent do: 4 read · 1 change · 1 delete · 1 send or post · 1 run or deploy

Install pkg in Claude Code, Cursor or VS Code

Runs npx -y @tneemo/pkg on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add pkg -- npx -y @tneemo/pkg
Add to Cursor

What the publisher says

From the pkg repository's README, as published. We do not edit it. Read it on GitHub

pkg

An open, agent-first marketplace for reusable software, at pkg.tneemo.com.

People publish free, reusable builds: small modules, integrations and complete project foundations, in any stack. A coding agent takes the idea and preferred stack from the conversation, finds compatible builds, installs and assembles them, and writes only what's missing. The agent spends tokens discovering software, not regenerating it.

# Connect your agent once (Claude Code, Cursor, Codex, Windsurf, Gemini CLI)
npx -y @tneemo/pkg setup

# ...or for Claude Code only
claude mcp add pkg -- npx -y @tneemo/pkg mcp

Then ask your agent for what you want to build. No spec files and no accounts.

Global CLI names

Node.js 20+ is required. npm install -g @tneemo/pkg installs both pkg and tpkg, pointing to the same CLI. The legacy Vercel pkg package also installs a global pkg executable. These names collide in a shared npm global prefix; installing both may fail with EEXIST or leave pkg pointing to the other tool. tpkg identifies this CLI once it is installed, but does not prevent the installation collision because both aliases are shipped.

For coexistence, avoid the global install and run an explicit package command:

npm exec --yes --package=@tneemo/pkg -- tpkg setup
npm exec --yes --package=@tneemo/pkg -- tpkg mcp

If you no longer need Vercel's tool, uninstall the unscoped pkg package before installing @tneemo/pkg globally. Do not use --force to overwrite its executable.

The official MCP Registry entry is io.github.tneemo/pkg. Maintainers: see public distribution and releases.

What it looks like

Asked for "a TypeScript REST API for a todo app where users sign up, log in and only see their own todos", the agent:

  1. searches pkg for each part (rest api, user accounts, database) with the stack it inferred;
  2. installs tneemo/hono-api tneemo/hono-auth tneemo/hono-rate-limit in one call. tneemo/sqlite-db is pulled in as a dependency and the stack is checked. After reviewing the dry-run plan, dependency installation is explicitly enabled with --install-deps, then the assembled tests run before adding application code;
  3. follows the integration notes (6 lines of wiring in src/app.ts), writes the todo routes, migration and tests (3 files, 113 lines);
  4. runs the tests (13 passing) and reports --worked for each build, which feeds the builds' reputation.

pkg supplied 23 of the 26 files and 519 lines; the agent wrote 3 files. This exact run is reproducible with the steps in Development.

How agents use it

MCP tools: searchbuilds, getbuild, installbuilds, updatebuilds, removebuilds, detectstack, reportoutcome, publishbuild.

CLI: search, info, detect, add, update, remove, list, init, publish, feedback, mcp, setup.

How it works

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

pkg: common questions

Is pkg MCP server safe?
Yes, by our scan: it is graded A (85/100). Read the pkg safety report
How do I install pkg?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does pkg need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is pkg maintained?
The last commit was 15 days ago (2026-10-19). The latest release is v0.1.0.
How does pkg compare with other MCP servers?
safety score 85/100 (higher than 70% of 48,255 servers); tools 8 (the typical server has 7); tools that change things 38% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.