# package-risk [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/makosdDavid/package-risk-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 173  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/package-risk

## Description
Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.

## Tools
Capabilities this server exposes over MCP:

- **package_risk** — Full verdict: maintenance, licence, advisories, deprecation
- **package_licence** — Licence expression and closed-source safety
- **package_advisories** — Open OSV advisories for the resolved version

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "package-risk": {
    "command": "npx",
    "args": ["-y","@makosdav/package-risk-mcp"],
    "env": {
      "EVM_PRIVATE_KEY": ""
    }
  }
}
```

**Requires environment variables:** `EVM_PRIVATE_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What package-risk does

The package-risk MCP server gives an agent three package-analysis operations. `package_risk` produces a combined verdict covering maintenance status, licence, advisories, and deprecation. `package_licence` reports the package's licence expression and whether it is suitable for closed-source use. `package_advisories` returns open OSV advisories associated with the resolved package version.

Each operation accepts a package ecosystem through `system`, the package identifier through `name`, and an optional `version`. Supported ecosystem values are npm, pypi, go, maven, cargo, and nuget. The tools are intended for dependency review rather than package installation or remediation.

## How it works

The connector is a thin client. It sends requests to the remote stateless API at `x402-package-risk.x402-package-risk.workers.dev`; it does not perform the package analysis locally. When a tool is called, the API initially responds with an HTTP 402 payment requirement. The connector uses `@x402/fetch` to create and sign an authorisation with the configured EVM private key, retries the request with payment attached, and receives the result after verification through Coinbase CDP and on-chain settlement.

Payment is made in USDC on Base mainnet. The documented call prices are $0.01 for the combined check and $0.005 each for the licence and advisory checks. There is no signup or API key. The connector spends only from the wallet configured for the MCP process, and the MCP client may provide any additional confirmation behavior.

## Setup and configuration

Run the connector through `npx` in an MCP client configuration. Set `EVM_PRIVATE_KEY` to an EVM wallet key with a small USDC balance on Base mainnet. The example package configuration uses `npx -y @makosdav/package-risk-mcp` as the command and passes the private key through the environment.

Use a wallet dedicated to automated calls and avoid placing significant funds in it. The material indicates that individual calls generally cost between $0.005 and $0.01, depending on the selected tool. No other environment variable or API credential is documented.

## Tools and capabilities

- `package_risk`: combines maintenance, licence, advisory, and deprecation findings.
- `package_licence`: checks the licence expression and closed-source safety.
- `package_advisories`: looks up open OSV advisories for the resolved version.
- Inputs cover six package ecosystems, package names, and optional versions.

## Limitations and notes

The package-risk MCP server depends on a remote HTTP service and an available Base mainnet wallet balance. Results are supplied by that service; the connector itself is not a local package database. A version can be omitted, in which case the service resolves the package version for the requested check.

Payment is automatic after a tool call reaches the payment step. The server checks package risk signals but does not install dependencies, fix vulnerabilities, or explain remediation steps.

_Full upstream README: https://allmcps.com/mcp/package-risk/readme_