Securityβ€’ MCP Alternatives Guide

Best Alternatives to Pkgproof

Looking for an alternative to Pkgproof? Whether you need a different runtime environment, custom authentication support, or alternative API integrations in the Security ecosystem, we have cataloged and compared the top alternative MCP servers below.

Browse all Security servers β†’View Pkgproof Specs β†’
Pkgproof logo
Target Reference Server

Pkgproof Overview

The pkgproof MCP server checks npm packages through pkgproof.net before installation. Its single `verify_package` tool accepts a package name, optional exact version, and optional ecosystem, then returns a verdict with sourced reasons marked as facts or heuristics. Use it when an agent needs a package-risk check before adding a dependency. The first verification per day is free; later checks require a configured wallet and cost $0.05 in USDC.

Primary Use Cases for Pkgproof:
  • Verify an npm dependency before adding it to a project
  • Check an exact package release for advisories and install scripts
  • Screen dependency names for typosquats and combosquats
  • Review a package's declared repository and scope

Specification Matrix: Pkgproof vs Alternatives

Direct comparison of key metrics, runtimes, authentication methods, and community popularity.

Server NameRuntimeAuthPricingGitHub StarsDownloadsAction
Pkgproof logoPkgproof (Target)
npxβ€”β€”β€”β€”Current
Auth0 MCP Server logoAuth0 MCP Servernpxβ€”β€”122β€”
Shodan logoShodannpxAPI keyBring your own API key (usage-based cost)189β€”
Agent Security Scanner MCP logoAgent Security Scanner MCPnpxβ€”β€”123β€”
Codeinspectus logoCodeinspectusnpxNo auth requiredFree51β€”
Binary Ninja MCP logoBinary Ninja MCPnpxNo auth requiredFree4561
EchelonGraph CVE & Exposure logoEchelonGraph CVE & ExposurenpxNo auth requiredFree21β€”
4da MCP Server logo4da MCP ServernpxNo auth requiredFreeβ€”β€”
Supply Chain Guard logoSupply Chain GuardnpxNo auth requiredFree7β€”
Semgrep logoSemgrepuvxNo auth requiredFree17,612β€”
AI Distiller MCP logoAI Distiller MCPnpxNo auth requiredFree172β€”
MCP Bastion logoMCP BastionnpxNo auth requiredFree7β€”
Lazaretto MCP logoLazaretto MCPnpxAPI keyFreemium1β€”

Detailed Evaluation of Pkgproof Alternatives

Auth0 MCP Server logo

Auth0 MCP Server

Runtime: npxSecurity
Official

Manage Auth0 applications, APIs, Actions, logs, forms, and users through natural-language MCP tools.

Key Features:
Natural-language Auth0 tenant management
Application, API, Action, log, form, and user operations
OAuth 2.0 device authorization
3 0 122
Shodan logo

Shodan

Runtime: npxSecurity

Connects AI agents to Shodan for host reconnaissance, device search, DNS lookups, and CVE intelligence.

Key Features:
IP reconnaissance with ports, banners, TLS, cloud, and CVE data
Shodan device search with pagination and facets
Forward, reverse, and domain DNS intelligence
3 0 189
Agent Security Scanner MCP logo

Agent Security Scanner MCP

Runtime: npxSecurity

Scans agent-written code, MCP servers, prompts, actions, and dependencies for security risks and package hallucinations.

Key Features:
Project, file, and Git diff security scans
MCP server, prompt, and agent action checks
AI-suggested package existence verification
3 0 123
Codeinspectus logo

Codeinspectus

Runtime: npxSecurity

Local MCP security scanner for AI-generated JavaScript and TypeScript with offline SAST, secrets, SCA, and AI-specific checks.

Key Features:
Offline local scanning with zero scan-time network egress
CWE-keyed findings across multiple security engines
AI-code-specific native detectors
7 0 51
Binary Ninja MCP logo

Binary Ninja MCP

Runtime: npxSecurity

Connects Binary Ninja to MCP clients for querying, decompiling, annotating, renaming, and retyping loaded binaries.

Key Features:
Function discovery, decompilation, IL, and disassembly
Function, variable, and data-label renaming
Address and function comment management
11 1 456
EchelonGraph CVE & Exposure logo

EchelonGraph CVE & Exposure

Runtime: npxSecurity

Keyless MCP access to CVE intelligence, KEV, EPSS, SBOM checks, advisories, and Shodan-derived exposure data.

Key Features:
Searches and summarizes fused CVE intelligence
Checks packages, CPE products, SBOMs, and lockfiles
Reports CISA KEV and EPSS history
3 0 21
4da MCP Server logo

4da MCP Server

Runtime: npxSecurity

Scans dependencies for vulnerabilities, evaluates upgrade safety and impact, and preserves project decisions and agent memory.

Key Features:
OSV.dev vulnerability scanning across supported lockfiles
Release, deprecation, yank, and freshness analysis
Project-aware upgrade impact and planning
0 0
Supply Chain Guard logo

Supply Chain Guard

Runtime: npxSecurity

Offline MCP security scanner for vetting packages, extensions, plugins, images, and CI actions across 15 ecosystems.

Key Features:
Offline local scanning
15-ecosystem threat matching
Manifest and lockfile discovery at any depth
9 0 7
Semgrep logo

Semgrep

Runtime: uvxSecurity
Official

Scans agent-generated code for security, supply-chain, and secret findings through Semgrep over MCP.

Key Features:
Semgrep Code analysis
Supply-chain checks
Secret detection
7 0 17,612
AI Distiller MCP logo

AI Distiller MCP

Runtime: npxSecurity

Distills codebases into compact API context and generates prompts for documentation, refactoring, security, and other AI analyses.

Key Features:
Distills individual files and directories into compact code structure
Filters public APIs, types, imports, documentation, and implementation details
Generates prompts for security, refactoring, bugs, documentation, and performance
5 0 172
MCP Bastion logo

MCP Bastion

Runtime: npxSecurity

Routes MCP clients through a proxy that reconnects servers, enforces runtime security, and records compliance-mapped audit events.

Key Features:
Health checks and backoff-based reconnection
Tool pinning and server-identity checks
Runtime authorization and delegation validation
2 0 7
Lazaretto MCP logo

Lazaretto MCP

Runtime: npxSecurity

Checks pinned dependencies and artifacts for malicious-package indicators and deterministic behavioral risks.

Key Features:
Lockfile checks for npm, Yarn, and pnpm
Known-bad SHA-256 hash lookup
Deterministic artifact behavioral analysis
4 0 1

Frequently Asked Questions: Pkgproof Alternatives

The top-rated alternatives to Pkgproof in the Security category include Auth0 MCP Server, Shodan, Agent Security Scanner MCP. These servers offer complementary or alternative capabilities depending on your deployment stack and authentication requirements.

Pkgproof and its alternatives vary by runtime requirement (Node.js/npx, Python/uvx, Docker, or remote HTTP/SSE endpoints). Check the specification comparison table above to verify command requirements before installing.

It varies by server. Pricing, auth and license are declared by each maintainer and shown in the comparison table where provided β€” a dash means nothing was declared, so check that project's own site before assuming it's free.

Click the "Compare side-by-side β†’" button on any alternative card to see an in-depth comparison matrix covering feature lists, stars, npm downloads, install configurations, and schema specifications.