Package Risk

io.github.makosdDavidPublished by GitHub account makosdDavidv1.0.5Updated Oct 27, 2026

Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.

VerifiedSTDIODesktop onlyFinanceDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that checks a package's maintenance status, licence and security advisories, paid per call in USDC on Base mainnet.

What you can do
  • Get a full risk verdict for a package: maintenance, licence, advisories and deprecation
  • Check a package's licence expression and whether it is safe for closed-source use
  • List open OSV advisories for a resolved package version
  • Query npm, PyPI, Go, Maven, Cargo or NuGet packages by name and optional version
When to use it
Use it before adding or upgrading a dependency, when you want an assistant to weigh maintenance health, licence terms and known vulnerabilities for a package in one step. It suits occasional checks where paying a few cents per call is preferable to a subscription or API key.
Requirements
Runs locally via npx from the npm package @makosdav/package-risk-mcp, so Node.js is needed. Requires an EVM wallet private key supplied in the EVM_PRIVATE_KEY environment variable, holding a small amount of USDC on Base mainnet. Network access to the remote HTTP API and to the payment verification service is required.
Before you install
The server holds a private key for an EVM wallet and signs payment authorisations with it; use a dedicated, lightly funded wallet, never a main one. Every tool call spends roughly $0.005 to $0.01 in USDC, and the README states there is no per-call approval prompt beyond what your MCP client asks for, so configure confirmation in your agent framework if you want it. Package names and versions are sent to a third-party HTTP API.

Installation

In SourceWeft

  1. Open Package Risk in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

package-risk MCP connector

MCP tools for checking a package's maintenance status, licence, and security advisories before you depend on it - package_risk, package_licence, package_advisories. Paid per call in USDC on Base mainnet via x402.

No subscription, no API key. You pay from your own wallet, per call, only for what you use.

What this is (and isn't)

This is a thin client. The actual service is a stateless HTTP API at x402-package-risk.x402-package-risk.workers.dev. This connector never sees, holds, or forwards anyone else's funds - it only ever spends the wallet key you configure below, and only when you call one of its tools.

Setup

You need an EVM wallet with a small amount of USDC on Base mainnet (calls cost $0.005-$0.01 each). Never use a wallet holding significant funds for an automated agent key - keep this one funded lightly.

Add to your MCP client config (Claude Desktop, Claude Code, Cursor, etc.):

json
{  "mcpServers": {    "package-risk": {      "command": "npx",      "args": ["-y", "@makosdav/package-risk-mcp"],      "env": {        "EVM_PRIVATE_KEY": "0xyour-private-key-here"      }    }  }}

Tools

ToolPriceWhat it returns
package_risk$0.01Full verdict: maintenance, licence, advisories, deprecation
package_licence$0.005Licence expression and closed-source safety
package_advisories$0.005Open OSV advisories for the resolved version

All three take system (npm/pypi/go/maven/cargo/nuget), name, and an optional version.

How payment works

  1. Your agent calls a tool.
  2. This connector requests the resource; the server replies 402 Payment Required.
  3. @x402/fetch builds and signs a payment authorisation with your key.
  4. The request retries with payment attached; the server verifies via Coinbase CDP, returns the result, and settles on-chain.

No approval prompt happens here beyond what your MCP client itself asks for - if you want per-call confirmation, configure that in your agent framework, not here.

Source: README.md at commit dc1cefb

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.5LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts