Skip to main content
Glama
Anicodeth

package-verify-mcp

by Anicodeth

package-verify-mcp

Catch hallucinated and typosquatted npm packages before your coding agent installs them.

An MCP server that verifies an npm package name is real and safe before Claude, Cursor, or any agent runs npm install. AI agents routinely invent plausible-sounding package names ("slopsquatting"), and attackers pre-register those exact names with malware — one hallucinated package (react-codeshift) spread into 237 repos. This server is the guardrail.

Why this exists

An agent confidently writes import x from "some-plausible-pkg" and then installs it. If that name doesn't exist, best case you get an error; worst case a squatter is waiting there with a postinstall script. Checking is one registry call — this makes the agent do it every time.

Related MCP server: npm-guardian

Tools

Tool

What it does

verify_package

Verdict for one name — SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST — from existence, first-publish age, weekly downloads, deprecation, and edit-distance to popular packages (typosquat detection).

verify_packages

Batch check — pass every dependency in a proposed change; flagged names sort to the top.

Uses only the public npm registry + downloads API. No key.

What the verdicts mean

  • ✅ SAFE — exists, established (age + downloads), not a near-miss of a popular name.

  • ⚠️ CAUTION — exists but young, low-traffic, deprecated, or a similar-but-established name. Confirm intent.

  • 🛑 SUSPICIOUS — one or two edits from a popular package and young/low-traffic: a classic typosquat. Don't install without confirming.

  • ❌ DOES_NOT_EXIST — not on npm. Hallucination signature — do not install; suggestions for the likely intended name are included.

Quick start

npx package-verify-mcp

Claude Code

claude mcp add package-verify -- npx -y package-verify-mcp

Claude Desktop / Cursor / Windsurf / any MCP client

{
  "mcpServers": {
    "package-verify": {
      "command": "npx",
      "args": ["-y", "package-verify-mcp"]
    }
  }
}

Pairs well with a rule like "Before adding any npm dependency, verify it with package-verify."

Example prompts

  • "Verify react-hook-forms before you install it." (→ 🛑 typosquat of react-hook-form)

  • "Check all the packages in this package.json diff with package-verify."

  • "Is @types/node-fetch a real package?"

Config

Env var

Default

Purpose

NPM_REGISTRY

https://registry.npmjs.org

Registry for existence/metadata.

NPM_API

https://api.npmjs.org

Downloads API for weekly-download signal.

How it works

package name
   │
   ├─ registry GET  ── exists? first-publish date, latest, deprecated, repo
   ├─ downloads API ── weekly downloads (traffic/trust signal)
   └─ edit-distance vs bundled popular-package list ── typosquat detection
        └─► SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST + reasons + suggestions

Caveats

  • This is a hallucination / typosquat tripwire, not a full security scanner — it won't analyze package contents (use Socket/npq for deep supply-chain analysis). It answers "is this name real and plausibly the one you meant."

  • The popular-package reference list is curated, not exhaustive; extend src/popular.ts for your stack.

Develop

npm install
npm run build
node dist/index.js

License

MIT © Anicodeth

Available Tools

2 tools
verify_packageVerify an npm package name before installingA

Check that an npm package name is REAL and safe before you run npm install on it. Reach for this whenever you are about to add a dependency you are not 100% certain exists — AI agents routinely hallucinate plausible-sounding package names ('slopsquatting'), and attackers pre-register those names with malware. Returns a verdict (SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST) with the reasons: existence on npm, first-publish age, weekly downloads, deprecation, and edit-distance to popular packages (typosquat detection). If it doesn't exist, do not install it.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesThe exact npm package name you intend to install, e.g. 'react-router-dom'.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full disclosure burden. It transparently explains the output: 'Returns a verdict (SAFE / CAUTION / SUSPICIOUS / DOES_NOT_EXIST) with the reasons' and lists the criteria (existence, age, downloads, deprecation, edit-distance). It also communicates the safety rationale. It does not mention whether the tool makes network calls or has side effects, but for a verification tool this is not a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences that flow logically: purpose, when to use, and output/behavior. It is front-loaded with the core function, and every sentence provides meaningful information without fluff. The structure is easy to parse and complete.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (one parameter, no output schema), the description is highly complete. It explains the return values and the reasons, which substitutes for an output schema. It also addresses the risk context. However, it could be slightly richer by clarifying how to act on CAUTION or SUSPICIOUS verdicts, but this is not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes the 'name' parameter with high coverage (100%). The description reinforces its meaning by saying 'the exact npm package name you intend to install' and ties it to the safety check, but it doesn't add new syntactic details beyond the schema. Therefore, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check that an npm package name is REAL and safe' and mentions it returns a verdict. It is specific about the resource (npm package name) and the action (checking). However, it does not explicitly differentiate from the sibling tool 'verify_packages' (plural), which may handle multiple packages, so it doesn't fully distinguish between them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: 'Reach for this whenever you are about to add a dependency you are not 100% certain exists' and warns against hallucinated package names. It also gives a clear exclusion-like rule: 'If it doesn't exist, do not install it.' However, it does not mention alternatives or explicitly say when not to use this tool (e.g., when verifying multiple packages, use the sibling).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_packagesVerify multiple package names at onceA

Batch version of verify_package: pass every dependency you're about to add (e.g. all the imports in a file or a proposed package.json diff) and get a verdict per name. Use before applying any change that adds dependencies, so a single hallucinated or typosquatted name is caught before install.

ParametersJSON Schema
NameRequiredDescriptionDefault
namesYesnpm package names to verify, e.g. ['react','reqeust','@acme/does-not-exist'].

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral disclosure burden. It mentions returning 'a verdict per name' but does not disclose important behaviors like how invalid names are handled, whether verification is concurrent, what the verdict format is, or any rate limits. The description is too vague for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the purpose ('Batch version of verify_package'), then immediately provides usage guidance. Every sentence contributes value without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (single parameter, no output schema), the description explains purpose and usage but omits return format and edge-case behavior. Without an output schema, the description should at least hint at what 'a verdict per name' looks like (e.g., boolean, object with reasons). It is adequate but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage for the single parameter 'names,' including a descriptive example ('['react','reqeust','@acme/does-not-exist']'). The description adds batch usage context but does not add new parameter-specific meaning beyond what the schema offers, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it is a 'Batch version of verify_package' and explains the action: 'pass every dependency you're about to add' and 'get a verdict per name.' This clearly identifies the verb (verify), resource (multiple package names), and distincts itself from the sibling verify_package by emphasizing batch processing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear timing context: 'Use before applying any change that adds dependencies, so a single hallucinated or typosquatted name is caught before install.' It implies usage for batch checks but does not explicitly state when not to use it or mention the single-version alternative beyond the 'Batch version' phrasing. Thus it has clear context but no explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.1.0
    • First observedverify_package
    • First observedverify_packages

TDQS

A4/5.0
Disambiguation5/5

The two tools are clearly distinguished by singular (verify_package) vs plural (verify_packages), making it obvious which to use for a single dependency vs a batch. The descriptions reinforce this distinction, so there is no risk of misselection.

Naming Consistency5/5

Both tools follow the exact same verb_noun pattern with snake_case (verify_package, verify_packages), and share the common 'verify_' prefix. The naming is perfectly parallel and predictable.

Tool Count3/5

With only 2 tools, the server feels slightly thin, but the narrow scope of npm package verification justifies having just a single and batch variant. The count is borderline but not extreme.

Completeness5/5

The server fully covers its stated domain: verifying npm package safety before install. The singular tool handles one package, and the batch tool handles any number, covering all realistic use cases. There are no obvious missing operations.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Pre-install risk gate for npm packages. Stops AI coding agents from running malicious or lifecycle scripts run.
    1
    2
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Audits npm packages for supply-chain attacks (typosquatting, malicious install scripts, credential exfiltration) before installation, returning a SAFE/SUSPICIOUS/DANGEROUS verdict.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Scans generated JavaScript/TypeScript code to detect AI-hallucinated or suspicious npm package imports before installation, providing a verdict of CLEAN, REVIEW, or BLOCK.
    80
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Validates and checks packages across 19 ecosystems to prevent AI agents from installing hallucinated, deprecated, or malicious packages.
    117
    AGPL 3.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Anicodeth/package-verify-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server