io.github.adamsjack711-ux/pkgxray

up checked 2026-11-10T21:37:52.149Z

Unclaimed · Unverified

Publisher-provided title

pkgxray

Publisher-provided description

Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.

Summary by lookupd

Scans npm packages and agent extension source for supply-chain risks before install, returning cited verdicts from registry metadata and…

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http pkgxray https://mcp.pkgxray.ca/mcp

Claude Code, npm package (stdio)

claude mcp add pkgxray -- npx -y pkgxray

Codex, remote (streamable-http)

codex mcp add pkgxray --url https://mcp.pkgxray.ca/mcp

Codex, npm package (stdio)

codex mcp add pkgxray -- npx -y pkgxray

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "pkgxray": {
      "url": "https://mcp.pkgxray.ca/mcp"
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "pkgxray": {
      "command": "npx",
      "args": [
        "-y",
        "pkgxray"
      ]
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

audit_agent_extension_supply_chain Statically inspect up to 16 KiB across 16 supplied source files. Does not download or execute packages. Results cover only the supplied evidence, not a verified
check_npm_package_metadata Check registry metadata and OSV advisories for one exact public npm version. Does not inspect package source, verify provenance, install or execute code. An adv

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.adamsjack711-ux/pkgxray.svg)](https://lookupd.com/servers/io.github.adamsjack711-ux/pkgxray)