SocketlistSecurity / pkgtruth
pkgtruth
io.github.hxckya/pkgtruth · v0.2.2
Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.
Install
npx -y pkgtruthTypical command from the package name. Check the README for required configuration and credentials before connecting it to real data.
Signals
| GitHub stars | 4 |
| npm weekly downloads | 61 |
| Last push | 3d ago |
| Licence | MIT |
| Open issues | 0 |
| SECURITY.md | Yes |
| Language | JavaScript |
| Latest version published | 2026-09-10 |
Signals captured from GitHub, npm and the official MCP Registry on October 15, 2026. See the scoring method.
Similar servers compare all →
SkillTotal
Score 80Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.
SUNGLASSES
Score 80Input firewall for AI agents: scan text and files before an agent reads them. Local, no network.
agent-security-scanner-mcp
Score 92Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.