MCP.Market

package-meta MCP server

by weiseer·io.github.weiseer/package-meta·v0.1.1
No reviews yet

npm/PyPI/Cargo package metadata + downloads + maintainer health.

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed package-meta yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

package-meta tools (4)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • find_by_maintainer

    All cached packages by a maintainer username. Useful for supply-chain audits.

  • get_download_stats

    Download counts for a package (daily/weekly/monthly).

  • get_maintainer_health

    Maintainer-health signals: days since release, open issues/PRs, maintainer count, composite score.

  • lookup_package

    Full metadata for a package — version, license, maintainers, repo, downloads, health.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 118 days ago8/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How package-meta compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,255 servers
Tools
4
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 4 read

Install package-meta in Claude Code, Cursor or VS Code

Runs npx -y @weiseer/package-meta-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add package-meta -- npx -y @weiseer/package-meta-mcp
Add to Cursor

What the publisher says

From the package-meta repository's README, as published. We do not edit it. Read it on GitHub

@weiseer/package-meta-mcp

npm/PyPI/Cargo package metadata + downloads + maintainer health. stdio MCP server.

Part of weiseer — AI-agent-native cached oracles.

Install

npm install -g @weiseer/package-meta-mcp

Use with Claude Desktop / Cursor / Cline / Continue / Windsurf

{
  "mcpServers": {
    "package-meta": {
      "command": "npx",
      "args": ["-y", "@weiseer/package-meta-mcp"]
    }
  }
}

Why use this instead of your agent doing it itself

The DIY cost in token-spend, latency, and rate-limit risk is 100-1500x our cost. See the weiseer organization README for the economic argument.

Environment

  • PKGMETAURL — override remote snapshot URL
  • PKGMETALOCAL_ONLY=1 — skip remote fetch

License

Apache-2.0

Nothing above is checked by us. What we check is on the safety report.

package-meta: common questions

Is package-meta MCP server safe?
Mostly: it is graded B (78/100). Read the package-meta safety report
How do I install package-meta?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does package-meta need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is package-meta maintained?
The last commit was 156 days ago (2026-06-01). The latest release is v0.1.1.
How does package-meta compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from weiseer →