Pkgtruth MCP Server

Ground truth about npm and PyPI packages, for AI coding agents and CI. Your agent just wrote npm install unused-imports. That package is not the linter plugin it meant. It is a name an attacker registered because models kept inventing it - and npm has since replaced it with a security placeholder. It runs locally over stdio via the published package.

People who work with dependency security, slopsquatting and typosquatting and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in JavaScript.

VERIFIED ACTIVE

LAST COMMIT 2026-09-14 · ★ 4 · #39 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

MIT · JavaScript servers · how we verify → /methodology

01 · Install Pkgtruth

Claude Code

claude mcp add hxckya-pkgtruth -- npx -y pkgtruth

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "hxckya-pkgtruth": {
      "command": "npx",
      "args": [
        "-y",
        "pkgtruth"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

repo age created 2026-08-31 - young repo, little track record yet

license MIT - declared in the repository

npm package pkgtruth - unscoped; check the name against the project README before installing

registry namespace io.github.hxckya is GitHub-verified and matches the repo owner

03 · What Pkgtruth can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Limitations (from the README)

- npm and PyPI only. crates.io, Go modules, RubyGems are not covered yet. - PyPI has no purge marker. npm leaves a -security placeholder where it removed malware; PyPI deletes the project, so a purged PyPI name simply reads as HALLUCINATED. PyPI also has no search API - near-twins are found against a daily snapshot of the top 15,000 projects by downloads, so an impostor of an obscure package will not be caught. - Reg

Latest releases

v0.2.2 · 2026-09-10

Highlights · pkgtruth hook - a Claude Code PreToolUse hook that denies npm install, npx, pnpm add, yarn add, bun add, deno add npm:, pip install, uv add/uvx, poetry add, pipx, pipenv, pdm commands when a package they…

04 · Who maintains Pkgtruth

pkgtruth is maintained by hxckya. It's the only MCP server we track from this author; the repo dates to Aug 2026.

05 · Facts

repository: github.com/hxckya/pkgtruth
category: security - ranked #39 of 204 actively-maintained security servers as of 2026-09-18.
release cadence: 1 release in the last 90 days (latest 2026-09-10)
registry: io.github.hxckya/pkgtruth (active, first published 2026-08-31 · 5 versions)
packages: npm:pkgtruth

06 · Pkgtruth FAQ

What is Pkgtruth?

Is Pkgtruth still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-14 and it shipped 1 release in the last 90 days. We re-verify nightly.

How do I install Pkgtruth?

Run `npx -y pkgtruth`. You can also paste the ready-made client config above.

Does Pkgtruth run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Pkgtruth

Alternatives to Pkgtruth

Maintained security servers if Pkgtruth isn't the fit.

Pairs well with

Servers that cover what Pkgtruth doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Q Ring · IdentArk Gateway · Thumb Gate · Inkog · Ironclaw

More JavaScript MCP servers · Signalfuse · CricketStudio MCP · Mcpbridge · Bbox MCP Server · Hadith Checker [Dorar.net] · see all