# Package Intel [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/adam121393/package-intel  
**GitHub Stars:** 0  
**npm Downloads (last month):** 156  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/package-intel

## Description
npm, PyPI & crates.io health, vulns and dependency graphs. Runs locally, no API key.

## Tools
Capabilities this server exposes over MCP:

- **package_snapshot** — Get a consolidated snapshot of an npm, PyPI or crates.io (Rust) package: latest version, license, description, repository, weekly downloads, maintainers, last publish date, and deprecation status. Free, no payment required.
- **package_vulns** — List known vulnerabilities (OSV.dev) for an npm, PyPI or crates.io (Rust) package. Pass a version to scope results to that version; omit it to see every advisory ever filed against the package. Free, no payment required.
- **package_deps** — Get the dependency graph for an npm, PyPI or crates.io (Rust) package: direct and transitive dependencies with versions and counts, with deprecated direct dependencies flagged. Free, no payment required.
- **package_downloads** — Get download counts for an npm, PyPI or crates.io (Rust) package over a time range. Free, no payment required.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "package-intel": {
    "command": "npx",
    "args": ["-y","package-intel-mcp"]
  }
}
```

## Documentation

## What Package Intel MCP server does

Package Intel MCP server connects an MCP-compatible agent to package data for npm, PyPI, and crates.io. Its free operations provide a consolidated package snapshot, known vulnerabilities, dependency information, and download counts. These calls do not require a wallet or API key.

The package also exposes paid health scoring through the underlying x402 API. Individual health scores return a 0–100 health or risk score, while batch scoring accepts up to 50 packages. The MCP client hides the payment retry flow from the agent when a funded wallet is configured.

## How it works

The MCP component is a standalone npm package named `package-intel-mcp`. It runs on the buyer’s machine as a stdio server and does not import the repository’s Hono or x402 server stack. With no wallet configured, it registers four free tools:

- `package_snapshot`
- `package_vulns`
- `package_deps`
- `package_downloads`

When `X402_PRIVATE_KEY` is present, it also registers `package_health` and `package_batch_health`. For a paid request, the client signs a USDC payment from that wallet and retries after receiving an HTTP 402 response. The private key belongs to the agent operator and should be treated as a hot key with a deliberately limited balance.

## Setup and configuration

The Package Intel MCP server can be started with `npx -y package-intel-mcp`, so the default setup needs no environment variables. Claude Desktop and Cursor configurations can launch the command directly. A typical MCP entry uses `npx` as the command and passes `-y` and `package-intel-mcp` as arguments.

Add `X402_PRIVATE_KEY` to enable the paid tools. A malformed private key causes a hard error instead of silently disabling the paid tools.

For development against a local instance, the repository provides `npm run mcp`. The consuming repository can also include guidance in `AGENTS.md`, `CLAUDE.md`, or `.cursor/rules` to tell an agent when to invoke the tools.

## Tools and capabilities

Package Intel MCP server covers four free information types: consolidated package metadata, OSV vulnerability results, deps.dev dependency graphs, and package download counts. Optional paid calls add single-package and multi-package health scoring. The upstream API supports npm, PyPI, and Rust crates through the `npm`, `pypi`, and `crates` ecosystems.

A separate GitHub Action in the repository reviews newly added dependencies in pull requests, but that workflow is distinct from the MCP client. It uses free endpoints and does not require the MCP server’s wallet configuration.

## Limitations and notes

Paid tools are unavailable unless `X402_PRIVATE_KEY` is valid and funded with USDC on the expected network. The MCP package itself does not require a wallet for its free tools. Payment credentials are automatically used for paid calls, so operators should avoid putting valuable funds in the configured wallet.

The server is intended for package intelligence rather than arbitrary package installation or mutation. Its documented ecosystems are npm, PyPI, and crates.io, and its documented data sources include OSV and deps.dev.

_Full upstream README: https://allmcps.com/mcp/package-intel/readme_