package-verify-mcp
Verifies npm package names for existence, age, downloads, deprecation, and typosquatting against popular packages before installation.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@package-verify-mcpVerifyreact-hook-formsbefore installing."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
package-verify-mcp
Catch hallucinated and typosquatted npm packages before your coding agent installs them.
An MCP server that verifies an npm package name is real and safe before Claude, Cursor, or any agent runs npm install. AI agents routinely invent plausible-sounding package names ("slopsquatting"), and attackers pre-register those exact names with malware — one hallucinated package (react-codeshift) spread into 237 repos. This server is the guardrail.
Why this exists
An agent confidently writes import x from "some-plausible-pkg" and then installs it. If that name doesn't exist, best case you get an error; worst case a squatter is waiting there with a postinstall script. Checking is one registry call — this makes the agent do it every time.
Related MCP server: npm-guardian
Tools
Tool | What it does |
| Verdict for one name — SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST — from existence, first-publish age, weekly downloads, deprecation, and edit-distance to popular packages (typosquat detection). |
| Batch check — pass every dependency in a proposed change; flagged names sort to the top. |
Uses only the public npm registry + downloads API. No key.
What the verdicts mean
✅ SAFE — exists, established (age + downloads), not a near-miss of a popular name.
⚠️ CAUTION — exists but young, low-traffic, deprecated, or a similar-but-established name. Confirm intent.
🛑 SUSPICIOUS — one or two edits from a popular package and young/low-traffic: a classic typosquat. Don't install without confirming.
❌ DOES_NOT_EXIST — not on npm. Hallucination signature — do not install; suggestions for the likely intended name are included.
Quick start
npx package-verify-mcpClaude Code
claude mcp add package-verify -- npx -y package-verify-mcpClaude Desktop / Cursor / Windsurf / any MCP client
{
"mcpServers": {
"package-verify": {
"command": "npx",
"args": ["-y", "package-verify-mcp"]
}
}
}Pairs well with a rule like "Before adding any npm dependency, verify it with package-verify."
Example prompts
"Verify
react-hook-formsbefore you install it." (→ 🛑 typosquat ofreact-hook-form)"Check all the packages in this package.json diff with package-verify."
"Is
@types/node-fetcha real package?"
Config
Env var | Default | Purpose |
|
| Registry for existence/metadata. |
|
| Downloads API for weekly-download signal. |
How it works
package name
│
├─ registry GET ── exists? first-publish date, latest, deprecated, repo
├─ downloads API ── weekly downloads (traffic/trust signal)
└─ edit-distance vs bundled popular-package list ── typosquat detection
└─► SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST + reasons + suggestionsCaveats
This is a hallucination / typosquat tripwire, not a full security scanner — it won't analyze package contents (use Socket/npq for deep supply-chain analysis). It answers "is this name real and plausibly the one you meant."
The popular-package reference list is curated, not exhaustive; extend
src/popular.tsfor your stack.
Develop
npm install
npm run build
node dist/index.jsLicense
MIT © Anicodeth
Available Tools
2 toolsverify_packageVerify an npm package name before installingA
Check that an npm package name is REAL and safe before you run npm install on it. Reach for this whenever you are about to add a dependency you are not 100% certain exists — AI agents routinely hallucinate plausible-sounding package names ('slopsquatting'), and attackers pre-register those names with malware. Returns a verdict (SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST) with the reasons: existence on npm, first-publish age, weekly downloads, deprecation, and edit-distance to popular packages (typosquat detection). If it doesn't exist, do not install it.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The exact npm package name you intend to install, e.g. 'react-router-dom'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full disclosure burden. It transparently explains the output: 'Returns a verdict (SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST) with the reasons' and lists the criteria (existence, age, downloads, deprecation, edit-distance). It also communicates the safety rationale. It does not mention whether the tool makes network calls or has side effects, but for a verification tool this is not a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences that flow logically: purpose, when to use, and output/behavior. It is front-loaded with the core function, and every sentence provides meaningful information without fluff. The structure is easy to parse and complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter, no output schema), the description is highly complete. It explains the return values and the reasons, which substitutes for an output schema. It also addresses the risk context. However, it could be slightly richer by clarifying how to act on CAUTION or SUSPICIOUS verdicts, but this is not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes the 'name' parameter with high coverage (100%). The description reinforces its meaning by saying 'the exact npm package name you intend to install' and ties it to the safety check, but it doesn't add new syntactic details beyond the schema. Therefore, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Check that an npm package name is REAL and safe' and mentions it returns a verdict. It is specific about the resource (npm package name) and the action (checking). However, it does not explicitly differentiate from the sibling tool 'verify_packages' (plural), which may handle multiple packages, so it doesn't fully distinguish between them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: 'Reach for this whenever you are about to add a dependency you are not 100% certain exists' and warns against hallucinated package names. It also gives a clear exclusion-like rule: 'If it doesn't exist, do not install it.' However, it does not mention alternatives or explicitly say when not to use this tool (e.g., when verifying multiple packages, use the sibling).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_packagesVerify multiple package names at onceA
Batch version of verify_package: pass every dependency you're about to add (e.g. all the imports in a file or a proposed package.json diff) and get a verdict per name. Use before applying any change that adds dependencies, so a single hallucinated or typosquatted name is caught before install.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes | npm package names to verify, e.g. ['react','reqeust','@acme/does-not-exist']. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral disclosure burden. It mentions returning 'a verdict per name' but does not disclose important behaviors like how invalid names are handled, whether verification is concurrent, what the verdict format is, or any rate limits. The description is too vague for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose ('Batch version of verify_package'), then immediately provides usage guidance. Every sentence contributes value without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (single parameter, no output schema), the description explains purpose and usage but omits return format and edge-case behavior. Without an output schema, the description should at least hint at what 'a verdict per name' looks like (e.g., boolean, object with reasons). It is adequate but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for the single parameter 'names,' including a descriptive example ('['react','reqeust','@acme/does-not-exist']'). The description adds batch usage context but does not add new parameter-specific meaning beyond what the schema offers, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it is a 'Batch version of verify_package' and explains the action: 'pass every dependency you're about to add' and 'get a verdict per name.' This clearly identifies the verb (verify), resource (multiple package names), and distincts itself from the sibling verify_package by emphasizing batch processing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear timing context: 'Use before applying any change that adds dependencies, so a single hallucinated or typosquatted name is caught before install.' It implies usage for batch checks but does not explicitly state when not to use it or mention the single-version alternative beyond the 'Batch version' phrasing. Thus it has clear context but no explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v0.1.0- First observed
verify_package - First observed
verify_packages
TDQS
The two tools are clearly distinguished by singular (verify_package) vs plural (verify_packages), making it obvious which to use for a single dependency vs a batch. The descriptions reinforce this distinction, so there is no risk of misselection.
Both tools follow the exact same verb_noun pattern with snake_case (verify_package, verify_packages), and share the common 'verify_' prefix. The naming is perfectly parallel and predictable.
With only 2 tools, the server feels slightly thin, but the narrow scope of npm package verification justifies having just a single and batch variant. The count is borderline but not extreme.
The server fully covers its stated domain: verifying npm package safety before install. The singular tool handles one package, and the batch tool handles any number, covering all realistic use cases. There are no obvious missing operations.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.
11check-package: block malicious npm/PyPI deps before your AI agent installs them. Free, no key.
Protects AI coding agents from installing malicious open source packages. Every npm and PyPI package is checked against SafeDep’s real-time threat intelligence before installation.
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Related MCP Servers
- AlicenseAqualityCmaintenancePre-install risk gate for npm packages. Stops AI coding agents from running malicious or lifecycle scripts run.12MIT
- AlicenseNot gradedqualityCmaintenanceAudits npm packages for supply-chain attacks (typosquatting, malicious install scripts, credential exfiltration) before installation, returning a SAFE/SUSPICIOUS/DANGEROUS verdict.MIT
- AlicenseNot gradedqualityCmaintenanceScans generated JavaScript/TypeScript code to detect AI-hallucinated or suspicious npm package imports before installation, providing a verdict of CLEAN, REVIEW, or BLOCK.80MIT
- AlicenseNot gradedqualityCmaintenanceValidates and checks packages across 19 ecosystems to prevent AI agents from installing hallucinated, deprecated, or malicious packages.117AGPL 3.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Anicodeth/package-verify-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server