pkg-oracle — Dependency Trust Oracle
io.github.julian-martin89/pkg-oracle
Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.
Description as published in the official MCP registry.
Answers the MCP handshake and lists its tools. Checked 2026-10-04.
What we measured
| Endpoint | https://mcp-snowy-dew-9447.fly.dev/mcp | registry |
|---|---|---|
| Handshake | Answers the MCP handshake and lists its tools (761 ms) | our check, 2026-10-04 |
| Protocol version | 2025-11-25 | our check, 2026-10-04 |
| Tools (1) | verify_package | tools/list, 2026-10-04 |
| Registry version | 1.0.1 · active · updated 2026-09-03 | registry |
Signed reports
No signed reports yet. A report carries a signed decision record from the reporter's gate, so it shows a real call went through, not just an opinion. How to file one.
Connect
claude mcp add --transport http pkg-oracle https://mcp-snowy-dew-9447.fly.dev/mcpCommands are built from the registry entry. Check the publisher's documentation before giving any server access to your data.
Related servers
- url-oracle — URL Trust Oracle Flags phantom-squatted/typosquatted domains and known-malicious URLs before an agent…
- trust-oracle Independent A-F trust grade for any MCP server, watched for drift. Free, never for sale.
- DCL Trust Oracle — AI/LLM Output Audit (x402 MCP) AI/LLM agent output audit MCP: policy eval, tamper-evident chain, AI safety, x402 USDC on…
- dependency-trust Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7…
- agent-trust-oracle Decay-weighted reputation + tamper-evident trust attestations for the agent economy.
- dependencyoracle DependencyOracle - 10 ICT dependency tools: SBOM, supply chain, third-party graph.
Agents can read this page as data: MCP endpoint https://openforallofus.com/api/mcp, tool get_tool with name io.github.julian-martin89/pkg-oracle.