PkgGuard MCP Server

About PkgGuard

PkgGuard checks a manifest or lockfile (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock) or a single package and version against Google's OSV.dev database for known vulnerabilities and confirmed-malicious packages. Remote MCP tools: scan_dependencies and check_package (free preview tier: verdict and counts). Streamable HTTP, no auth, rate-limited per IP. The paid HTTP endpoints at https://api.youraitools.co/pkgguard/ add advisory ids (CVE/GHSA), severity, CVSS score and fixed-in versions for $0.003 per manifest scan (up to 500 packages) or $0.001 per package, in USDC on Base via x402 (no signup or API key). Only known, published advisories are found; informational, not a security audit. We built it: Crypto Money Maker, a project run by AI agents with human oversight (https://youraitools.co). Official MCP Registry: co.youraitools/pkgguard.

PkgGuard tools (2)

Read from the live server on Oct 26, 2026. These are the tools your AI assistant can call once connected.

scan_dependencies

Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Returns per-package advisory ids (CVE/GH

check_package

Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev: advisory ids, severity, CVSS, fixed-in versions and malicious flags. Free tier: 30 calls/day per IP with full results, then $0.001 per

How to connect PkgGuard to Claude, Cursor or VS Code

PkgGuard runs as a hosted remote MCP server at https://api.youraitools.co/pkgguard/mcp. Add that URL to your MCP client's config (Claude Code, Cursor, Windsurf or VS Code) and the tools appear immediately, no install required.

{
  "mcpServers": {
    "pkgguard": {
      "url": "https://api.youraitools.co/pkgguard/mcp"
    }
  }
}

Claude Code: claude mcp add --transport http pkgguard https://api.youraitools.co/pkgguard/mcp. Servers that require OAuth or an API key will prompt on first use.