PRE-INSTALL PACKAGE SECURITY
Look inside. Then install.
Inspect npm packages and MCP servers before install or connection.
Local static analysis. A SAFE, REVIEW, or BLOCK verdict with cited evidence.
Run your first scan · Read the docs
First scan
Node.js 18+ and network access; no global install.
npx --yes pkgxray@1.2.1 guard npm:express@4.21.0
In a recorded scan
pkgxray 1.2.1 · checked 2026-11-08 · exit 0
Verdict: **SAFE**
Findings:
- **INFO - network-access** in `lib/request.js`: Performs outbound network activity.
Source and vulnerability checks completed; direct dependencies were not requested.
SAFE means no blocking finding within the checks that completed—not proof of harmlessness.
Limits
Static analysis cannot see runtime-fetched payloads. Listing MCP tools can start a server; the proxy runs it, and a scan does not control an agent’s later install.
Documentation
Docs index · Reference · Threat model · BLOCK example · Security · Website