Log inSubmit server
Package Intel logo

Package Intel

Local stdio tools for npm, PyPI, and crates.io package health, vulnerabilities, dependencies, downloads, and optional paid risk scores.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Package Intel

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "package-intel": {
      "command": "npx",
      "args": [
        "-y",
        "package-intel-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 4 tools correctly (22d ago).

Overview

Package Intel MCP server gives AI coding agents package intelligence for npm, PyPI, and crates.io through a local stdio process. It exposes free tools for package snapshots, vulnerabilities, dependency graphs, and download counts without configuration or an API key. Setting X402_PRIVATE_KEY enables paid health and batch-health tools, which sign USDC payments automatically when the API returns a payment request. Reach for it when an agent needs package risk or dependency data during coding and review workflows.

Use cases

  • Inspect package health during coding tasks
  • Check dependencies for known vulnerabilities
  • Review dependency graphs for npm, PyPI, or Rust packages
  • Compare package download counts
  • Score up to 50 packages in one paid request

Key features

  • Free package snapshots
  • OSV vulnerability lookups
  • deps.dev dependency graphs
  • Package download counts
  • Optional x402-paid health scores
  • Batch health scoring for up to 50 packages

Tools4

What Package Intel lets your agent do. Expand a tool for its parameters.

Verified live~693 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

8/12 checks healthy over the last 91d

What it can do

From the 4 tools this server returned when we ran it; 4 declare their own safety hints.

Makes network requests · 4Read-only tools · 4
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age70 days
Maintainers1

Observed 2026-10-18 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2d ago via OSV.dev · package-intel-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads156Package downloads in the last 30 days.
Last commit2mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed4Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Package Intel works

What Package Intel MCP server does

Package Intel MCP server connects an MCP-compatible agent to package data for npm, PyPI, and crates.io. Its free operations provide a consolidated package snapshot, known vulnerabilities, dependency information, and download counts. These calls do not require a wallet or API key.

The package also exposes paid health scoring through the underlying x402 API. Individual health scores return a 0–100 health or risk score, while batch scoring accepts up to 50 packages. The MCP client hides the payment retry flow from the agent when a funded wallet is configured.

How it works

The MCP component is a standalone npm package named package-intel-mcp. It runs on the buyer’s machine as a stdio server and does not import the repository’s Hono or x402 server stack. With no wallet configured, it registers four free tools:

  • package_snapshot
  • package_vulns
  • package_deps
  • package_downloads

When X402_PRIVATE_KEY is present, it also registers package_health and package_batch_health. For a paid request, the client signs a USDC payment from that wallet and retries after receiving an HTTP 402 response. The private key belongs to the agent operator and should be treated as a hot key with a deliberately limited balance.

Setup and configuration

The Package Intel MCP server can be started with npx -y package-intel-mcp, so the default setup needs no environment variables. Claude Desktop and Cursor configurations can launch the command directly. A typical MCP entry uses npx as the command and passes -y and package-intel-mcp as arguments.

Add X402_PRIVATE_KEY to enable the paid tools. A malformed private key causes a hard error instead of silently disabling the paid tools.

For development against a local instance, the repository provides npm run mcp. The consuming repository can also include guidance in AGENTS.md, CLAUDE.md, or .cursor/rules to tell an agent when to invoke the tools.

Tools and capabilities

Package Intel MCP server covers four free information types: consolidated package metadata, OSV vulnerability results, deps.dev dependency graphs, and package download counts. Optional paid calls add single-package and multi-package health scoring. The upstream API supports npm, PyPI, and Rust crates through the npm, pypi, and crates ecosystems.

A separate GitHub Action in the repository reviews newly added dependencies in pull requests, but that workflow is distinct from the MCP client. It uses free endpoints and does not require the MCP server’s wallet configuration.

Limitations and notes

Paid tools are unavailable unless X402_PRIVATE_KEY is valid and funded with USDC on the expected network. The MCP package itself does not require a wallet for its free tools. Payment credentials are automatically used for paid calls, so operators should avoid putting valuable funds in the configured wallet.

The server is intended for package intelligence rather than arbitrary package installation or mutation. Its documented ecosystems are npm, PyPI, and crates.io, and its documented data sources include OSV and deps.dev.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Package Intel

Package Intel is an MCP server that connects AI coding agents to npm, PyPI, and crates.io package data through free snapshot, vulnerability, dependency, and download tools, plus paid health and batch health tools using x402 USDC payments when configured. It runs locally over stdio and needs no wallet for free operations.

Install it through an MCP client with `npx -y package-intel-mcp`. The standalone package runs as a local stdio server and requires no configuration for its free tools. The repository also provides `npm run mcp` for running the client from source against a local server.

Set `X402_PRIVATE_KEY` in the MCP client environment. The server then registers `package_health` and `package_batch_health`, signs USDC payments from that wallet after a 402 response, and retries the request. The wallet must be funded with USDC on the configured network.

Yes, Package Intel can be configured for Cursor as a stdio MCP server. Add the `npx -y package-intel-mcp` command to Cursor’s MCP configuration. Free tools work without a wallet; paid health tools additionally require `X402_PRIVATE_KEY`.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewPackage Intel AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/package-intel?style=directory)](https://allmcps.com/mcp/package-intel)
HTML Embed
<a href="https://allmcps.com/mcp/package-intel"><img src="https://allmcps.com/api/badge/package-intel?style=directory" alt="Package Intel on AllMCPs" /></a>