HALLUX

dev.blvkwarePublished by blvkware.devOfficial publisherv0.1.0Updated Oct 24, 2026

Check that a package, module or DOI exists before an agent installs, imports or cites it.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

HALLUX verifies that package names, modules and DOIs actually exist before an assistant installs, imports or cites them.

What you can do
  • Check a single identifier before acting on it, returning a verdict such as exists, deprecated, absent, phantom, squat or unknown, with a successor when deprecated
  • Pre-check install commands for npm, yarn, pnpm, bun, pip, uv, poetry, pipx, cargo, go get, dotnet and nuget before running them
  • Scan a whole dependency file in one pass (package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod), including dev and optional groups
  • Register identifiers to be notified when their verdict changes, for example when a phantom name becomes a registered squat
When to use it
Useful when an assistant writes or edits dependency files, runs package installs, or cites packages, modules and DOIs it recalled rather than read, to catch invented or typosquatted names before they reach a project.
Requirements
Remote streamable HTTP endpoint at api.blvkware.dev; no packages, environment variables or headers are declared, and no authentication is declared.
Before you install
The server receives the identifiers and dependency files you submit, including full dependency manifests, so review what is sent. Verdicts are advisory: an exists result does not guarantee a package is safe, and absent or phantom names still need a human decision.

Installation

In SourceWeft

  1. Open HALLUX in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.blvkware%2Fhallux/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "hallux": {
      "type": "http",
      "url": "https://api.blvkware.dev/hallux/mcp"
    }
  }
}

Tools

4

hallux_check_command

Check an install command before running it

Call this BEFORE running any command that installs a dependency: npm, yarn, pnpm, bun, pip, uv, poetry, pipx, cargo, go get, dotnet add package, nuget. Language models invent plausible package names that have never existed, and attackers register those names because they can predict them. Installing one runs attacker code. You cannot tell the difference by looking at the name, which is why this check exists. Pass the command exactly as you intend to run it. The identifiers are extracted for you. If the result says BLOCK, do not run the command. Use the `successor` if one is given, otherwise tell the user what was found and stop.

Parameterscommandrequired

hallux_check

Check identifiers

Does this identifier actually exist? Call before acting on any name you recalled rather than read: a package to install, a module to import, a DOI to cite. Returns one of: exists, deprecated, absent, phantom, squat, unknown. exists - proceed deprecated - proceed, but use `successor` absent - not in the registry. Do not proceed phantom - does not exist AND models repeatedly invent it. Do not proceed squat - was invented by models, then registered by someone. Treat as hostile unknown - could not verify. Never treat this as permission Live namespaces: cite.doi, pkg.crates, pkg.go, pkg.maven, pkg.npm, pkg.nuget, pkg.pypi. An unsupported namespace returns `unknown`, never an error, so it is safe to ask.

Parametersidentifiersrequired

hallux_check_manifest

Check a dependency file

Call this after writing or editing a dependency file, and before committing it. Supported: package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod. Checks every dependency in one pass, including dev and optional groups, which is where an invented name usually arrives.

Parameterscontentrequiredfilenamerequired

hallux_watch

Be told if a name turns hostile later

Register identifiers for notification when their verdict changes. The transition that matters is phantom to squat: a name models invent that somebody then registers. Use this for a dependency that came back `absent` or `phantom` and that the user intends to use anyway, or for a set of dependencies worth monitoring. Delivered by signed webhook to a URL you supply.

ParameterscallbackUrlrequiredidentifiersrequired

Version history

1
  1. v0.1.0LatestSep 23, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.