About KarmaDue
KarmaDue is a read-only pre-install safety-check MCP server for AI agents. It checks packages and MCP servers for documented traps, fixes, or malicious-package reports, while distinguishing missing evidence from a clean bill of health.
Key features
- 01Checks packages before installation
- 02Returns tested fix steps and warnings
- 03Flags reported malicious packages
- 04Read-only checks without an account
- 05Includes dated test records
Use cases
- 01Check npm or pip packages before installing
- 02Review an MCP server before adding it
- 03Find fixes for known install traps
MCP support
Exposes check_install, search_recipes, and report_leaf to MCP clients. OAuth 2.1 endpoints also provide search and fetch.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://karmadue--mcp.expo.app/mcpclaude mcp add --transport http ashadow07-karmadue https://karmadue--mcp.expo.app/mcp{"mcpServers":{"ashadow07-karmadue":{"type":"http","url":"https://karmadue--mcp.expo.app/mcp"}}}Open in Cursor{"servers":{"ashadow07-karmadue":{"type":"http","url":"https://karmadue--mcp.expo.app/mcp"}}}Open in VS Code{"mcpServers":{"ashadow07-karmadue":{"type":"http","url":"https://karmadue--mcp.expo.app/mcp"}}}{"mcpServers":{"ashadow07-karmadue":{"serverUrl":"https://karmadue--mcp.expo.app/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
https://karmadue--mcp.expo.app/mcphttps://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/connectorhttps://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcpTools
5| Parameter | Type | Required | Description |
|---|---|---|---|
| target | string | Yes | Package or server as you would install it, e.g. tailwindcss@4, psycopg2, @modelcontextprotocol/server-filesystem. |
| ecosystem | enum | Yes | npm | pypi | mcp |
| runtime_env | string | No | Optional, e.g. node 20 linux. |
Details
From the project READMEKarmaDue
A pre-install check for AI agents. Before your agent runs npm install, pip install, uv add, npx/uvx, or adds an MCP server, it calls check_install and gets one answer: a known trap with tested fix steps (fix_first), a warn, a deny for a malicious-package report, no_known_issues, or unknown (no evidence; not safety clearance).
- Read-only. Nothing runs your command.
- No account or key for reads. Anonymous limit: 30 requests/hour per IP.
- Every fix cites a dated test record. Seed records are labeled "Founder-operated assessment, not independent".
- Honest limits: lockfile installs (
npm ci,pip install -r) and transitive dependencies are not covered.
Try it (no account)
curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_install","arguments":{"target":"tailwindcss@4","ecosystem":"npm","runtime_env":"node 20 linux"}}}'
MCP server
| Endpoint (Streamable HTTP) | Auth | Tools |
|---|---|---|
https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp | none for reads | check_install, search_recipes, report_leaf |
https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/connector | OAuth 2.1 (Claude, ChatGPT) | same, plus search, fetch |
https://karmadue--mcp.expo.app/mcp | OAuth 2.1 mirror (strict clients) | same as connector |
Claude Code: claude mcp add --transport http karmadue https://karmadue--mcp.expo.app/mcp
What is in this repository
| Path | What |
|---|---|
guard/ | karmadue-guard: shims for npm/npx/pnpm/yarn and pip/uv that check before installing. Local-only log, no secrets. Install: curl -fsSL https://karmadue.expo.app/guard/install.sh | sh |
claude-code/ | Claude Code PreToolUse hook (karmadue-preinstall.js, no dependencies) and .mcp.json |
docs/ | The agent docs as published at https://karmadue.expo.app/docs/ (quick start, tools, permissions, security, changelog) |
llms.txt | https://karmadue.expo.app/llms.txt |
data/seed-records.json | The published seed records (tested install traps and fixes), snapshot of https://karmadue.expo.app/docs/seed-records.json |
The server and database are hosted and are not part of this repository.
Links
- Site: https://karmadue.expo.app
- Quick start: https://karmadue.expo.app/docs/mcp.md
- Official MCP Registry name:
io.github.ashadow07/karmadue
License
MIT, see LICENSE. Seed records describe third-party packages and are provided as dated observations, not guarantees.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.