io.github.julian-martin89/pkg-oracle

name:io.github.julian-martin89/pkg-oracle

Pay-per-call dependency trust oracle: verifies npm/PyPI packages before an AI agent installs them.

transport:: remote
credential class:: self-provisionable

Owner verification

Not yet verified. Verifying proves you control this server and is free, permanently — it never changes a published score.

Start verification →

Tools

verify_package
Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.
shallow

Embed this server’s score

Tool count and median score across every tool in this server’s corpus — honest in a way a single cherry-picked tool’s badge wouldn’t be.

[![Vouch score](https://vouch.tools/api/servers/8b8a0801-cb57-4019-bde7-7626f05fcc4c/badge.svg)](https://vouch.tools/servers/8b8a0801-cb57-4019-bde7-7626f05fcc4c)