Log inSubmit server
Package Risk logo

Package Risk

Checks package maintenance, licences, deprecation, and OSV advisories across npm, PyPI, Go, Maven, Cargo, and NuGet.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Package Risk

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "package-risk": {
      "command": "npx",
      "args": [
        "-y",
        "@makosdav/package-risk-mcp"
      ],
      "env": {
        "EVM_PRIVATE_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @makosdav/package-risk-mcp

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 21d ago.

Overview

The package-risk MCP server evaluates package maintenance, licence safety, deprecation, and known security advisories before adoption. It runs as a thin stdio connector that sends tool requests to a stateless HTTP API and accepts npm, PyPI, Go, Maven, Cargo, and NuGet package identifiers. Calls cost USDC on Base mainnet through x402, with payment signed by the configured EVM wallet and no API key or subscription. Reach for it when an agent needs a package due-diligence check before adding or approving a dependency.

Use cases

  • Review a dependency before adding it to a project
  • Check whether a package licence permits closed-source use
  • Find open OSV advisories for a resolved package version
  • Screen packages for maintenance or deprecation concerns

Key features

  • Combined package risk verdicts
  • Licence and closed-source safety checks
  • OSV advisory lookups
  • Maintenance and deprecation checks
  • Support for six package ecosystems
  • Per-call USDC payments through x402

Tools3

What Package Risk lets your agent do. Expand a tool for its parameters.

Self-reported~48 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 38d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 12d ago via OSV.dev · @makosdav/package-risk-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads173Package downloads in the last 30 days.
Last commit2mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed3Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Package Risk works

What package-risk does

The package-risk MCP server gives an agent three package-analysis operations. package_risk produces a combined verdict covering maintenance status, licence, advisories, and deprecation. package_licence reports the package's licence expression and whether it is suitable for closed-source use. package_advisories returns open OSV advisories associated with the resolved package version.

Each operation accepts a package ecosystem through system, the package identifier through name, and an optional version. Supported ecosystem values are npm, pypi, go, maven, cargo, and nuget. The tools are intended for dependency review rather than package installation or remediation.

How it works

The connector is a thin client. It sends requests to the remote stateless API at x402-package-risk.x402-package-risk.workers.dev; it does not perform the package analysis locally. When a tool is called, the API initially responds with an HTTP 402 payment requirement. The connector uses @x402/fetch to create and sign an authorisation with the configured EVM private key, retries the request with payment attached, and receives the result after verification through Coinbase CDP and on-chain settlement.

Payment is made in USDC on Base mainnet. The documented call prices are $0.01 for the combined check and $0.005 each for the licence and advisory checks. There is no signup or API key. The connector spends only from the wallet configured for the MCP process, and the MCP client may provide any additional confirmation behavior.

Setup and configuration

Run the connector through npx in an MCP client configuration. Set EVM_PRIVATE_KEY to an EVM wallet key with a small USDC balance on Base mainnet. The example package configuration uses npx -y @makosdav/package-risk-mcp as the command and passes the private key through the environment.

Use a wallet dedicated to automated calls and avoid placing significant funds in it. The material indicates that individual calls generally cost between $0.005 and $0.01, depending on the selected tool. No other environment variable or API credential is documented.

Tools and capabilities

  • package_risk: combines maintenance, licence, advisory, and deprecation findings.
  • package_licence: checks the licence expression and closed-source safety.
  • package_advisories: looks up open OSV advisories for the resolved version.
  • Inputs cover six package ecosystems, package names, and optional versions.

Limitations and notes

The package-risk MCP server depends on a remote HTTP service and an available Base mainnet wallet balance. Results are supplied by that service; the connector itself is not a local package database. A version can be omitted, in which case the service resolves the package version for the requested check.

Payment is automatic after a tool call reaches the payment step. The server checks package risk signals but does not install dependencies, fix vulnerabilities, or explain remediation steps.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Package Risk

package-risk is an MCP server that connects agent clients to a stateless package-risk HTTP API. Its main tools are package_risk for maintenance, licence, advisory, and deprecation findings; package_licence for licence safety; and package_advisories for open OSV issues. It supports npm, PyPI, Go, Maven, Cargo, and NuGet packages.

Install it by configuring your MCP client to run `npx -y @makosdav/package-risk-mcp` and setting `EVM_PRIVATE_KEY`. The wallet must hold a small amount of USDC on Base mainnet. No API key or signup is required.

The full `package_risk` check costs $0.01 per call, while `package_licence` and `package_advisories` cost $0.005 each. Charges are paid in USDC on Base mainnet through x402 from the configured wallet.

package-risk supports npm, PyPI, Go, Maven, Cargo, and NuGet. Each tool accepts the ecosystem, package name, and an optional version.

Yes, package-risk can be configured in Cursor using the standard MCP command and environment setting shown in the README. The same setup is also documented for Claude Desktop and Claude Code.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewPackage Risk AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/package-risk?style=directory)](https://allmcps.com/mcp/package-risk)
HTML Embed
<a href="https://allmcps.com/mcp/package-risk"><img src="https://allmcps.com/api/badge/package-risk?style=directory" alt="Package Risk on AllMCPs" /></a>