Pkgtruth MCP Server

Pkgtruth is an MCP integration. Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

Packages and local setup

The published npm package is pkgtruth, version 0.2.2. Its declared MCP transport is stdio.

The package declares PKGTRUTH_REGISTRY: Alternate npm registry to verify against. Defaults to https://registry.npmjs.org.; PKGTRUTH_DOWNLOADS_API: Alternate downloads API used for adoption figures. Defaults to https://api.npmjs.org.; PKGTRUTH_CACHE_DIR: Where adoption figures are cached between runs. Defaults to ~/.cache/pkgtruth.; PKGTRUTH_TIMEOUT_MS: Per-request timeout in milliseconds. Defaults to 8000..

Before connecting

Check the maintainer’s instructions for account access, authentication and the supported client configuration. Once connected, inspect the tools your client receives and try a small task that matches the server’s stated purpose. The registry description does not include a verified, complete tool list.

Project and source

View the publisher’s registry entry · Project repository. This profile uses version 0.2.2 from the registry. Registration identifies the publisher namespace; it does not establish that this is a first-party integration for every service it connects.

Browse related developer tools MCP servers for tools that cover the same kind of work.