mcpField
P
package-risk

package-risk

Local
github.com/makosdDavidSecurity0Updated 11w ago
Repository

About package-risk

package-risk is a thin MCP connector for checking package maintenance, licensing, and security advisories before adoption. It charges per call in USDC on Base through x402, without a subscription or API key.

Key features

  1. 01Package maintenance verdicts
  2. 02Licence and closed-source safety checks
  3. 03Open OSV advisory lookup
  4. 04Per-call USDC payments via x402

Use cases

  1. 01Assess a dependency before adding it
  2. 02Check licence conditions for a package
  3. 03Review advisories for a specific version

MCP support

The MCP server exposes `package_risk`, `package_licence`, and `package_advisories` tools. It calls a stateless HTTP API and pays per request using the configured EVM wallet.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "makosddavid-package-risk": {
      "command": "npx",
      "args": [
        "-y",
        "@makosdav/package-risk-mcp"
      ],
      "env": {
        "EVM_PRIVATE_KEY": "<EVM_PRIVATE_KEY>"
      }
    }
  }
}
Run commandnpx -y @makosdav/package-risk-mcp
Environment variables to set
EVM_PRIVATE_KEYSecretPrivate key of an EVM wallet holding a small amount of USDC on Base mainnet. Each tool call spends $0.005-$0.01 from it. Use a lightly funded key dedicated to this agent, never a main wallet.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@makosdav/package-risk-mcp1.0.5

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

package-risk MCP connector

MCP tools for checking a package's maintenance status, licence, and security advisories before you depend on it - package_risk, package_licence, package_advisories. Paid per call in USDC on Base mainnet via x402.

No subscription, no API key. You pay from your own wallet, per call, only for what you use.

What this is (and isn't)

This is a thin client. The actual service is a stateless HTTP API at x402-package-risk.x402-package-risk.workers.dev. This connector never sees, holds, or forwards anyone else's funds - it only ever spends the wallet key you configure below, and only when you call one of its tools.

Setup

You need an EVM wallet with a small amount of USDC on Base mainnet (calls cost $0.005-$0.01 each). Never use a wallet holding significant funds for an automated agent key - keep this one funded lightly.

Add to your MCP client config (Claude Desktop, Claude Code, Cursor, etc.):

{
  "mcpServers": {
    "package-risk": {
      "command": "npx",
      "args": ["-y", "@makosdav/package-risk-mcp"],
      "env": {
        "EVM_PRIVATE_KEY": "0xyour-private-key-here"
      }
    }
  }
}

Tools

ToolPriceWhat it returns
package_risk$0.01Full verdict: maintenance, licence, advisories, deprecation
package_licence$0.005Licence expression and closed-source safety
package_advisories$0.005Open OSV advisories for the resolved version

All three take system (npm/pypi/go/maven/cargo/nuget), name, and an optional version.

How payment works

  1. Your agent calls a tool.
  2. This connector requests the resource; the server replies 402 Payment Required.
  3. @x402/fetch builds and signs a payment authorisation with your key.
  4. The request retries with payment attached; the server verifies via Coinbase CDP, returns the result, and settles on-chain.

No approval prompt happens here beyond what your MCP client itself asks for - if you want per-call confirmation, configure that in your agent framework, not here.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.