English Français العربية

io.github.makosdDavid/package-risk

السجل الرسمي أخرى

Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

NPM package @makosdav/package-risk-mcp
Claude Code 
claude mcp add package-risk -e 'EVM_PRIVATE_KEY=<your evm_private_key>' -- npx -y @makosdav/package-risk-mcp@1.0.5
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "package-risk": {
            "command": "npx",
            "args": [
                "-y",
                "@makosdav/package-risk-mcp@1.0.5"
            ],
            "env": {
                "EVM_PRIVATE_KEY": "<your evm_private_key>"
            }
        }
    }
}

متغيرات البيئة

  • EVM_PRIVATE_KEY إلزامي سري Private key of an EVM wallet holding a small amount of USDC on Base mainnet. Each tool call spends $0.005-$0.01 from it. Use a lightly funded key dedicated to this agent, never a main wallet.

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. package-risk MCP connector
  2. What this is (and isn't)
  3. Setup
  4. Tools
  5. How payment works

package-risk MCP connector

MCP tools for checking a package's maintenance status, licence, and security advisories before you depend on it - package_risk, package_licence, package_advisories. Paid per call in USDC on Base mainnet via x402.

No subscription, no API key. You pay from your own wallet, per call, only for what you use.

What this is (and isn't)

This is a thin client. The actual service is a stateless HTTP API at x402-package-risk.x402-package-risk.workers.dev. This connector never sees, holds, or forwards anyone else's funds - it only ever spends the wallet key you configure below, and only when you call one of its tools.

Setup

You need an EVM wallet with a small amount of USDC on Base mainnet (calls cost $0.005-$0.01 each). Never use a wallet holding significant funds for an automated agent key - keep this one funded lightly.

Add to your MCP client config (Claude Desktop, Claude Code, Cursor, etc.):

{
  "mcpServers": {
    "package-risk": {
      "command": "npx",
      "args": ["-y", "@makosdav/package-risk-mcp"],
      "env": {
        "EVM_PRIVATE_KEY": "0xyour-private-key-here"
      }
    }
  }
}

Tools

ToolPriceWhat it returns
package_risk$0.01Full verdict: maintenance, licence, advisories, deprecation
package_licence$0.005Licence expression and closed-source safety
package_advisories$0.005Open OSV advisories for the resolved version

All three take system (npm/pypi/go/maven/cargo/nuget), name, and an optional version.

How payment works

  1. Your agent calls a tool.
  2. This connector requests the resource; the server replies 402 Payment Required.
  3. @x402/fetch builds and signs a payment authorisation with your key.
  4. The request retries with payment attached; the server verifies via Coinbase CDP, returns the result, and settles on-chain.

No approval prompt happens here beyond what your MCP client itself asks for - if you want per-call confirmation, configure that in your agent framework, not here.

الأسئلة الشائعة

ما هو io.github.makosdDavid/package-risk؟

Package risk checks: maintenance, licence, advisories. Paid per call in USDC, no signup.

كيف أثبّت io.github.makosdDavid/package-risk؟

يعمل على جهازك. في Claude Code: claude mcp add package-risk -e 'EVM_PRIVATE_KEY=<your evm_private_key>' -- npx -y @makosdav/package-risk-mcp@1.0.5. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج io.github.makosdDavid/package-risk إلى مفتاح API؟

نعم. يتطلب EVM_PRIVATE_KEY، وتضبطها في إعداداته.

هل io.github.makosdDavid/package-risk مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون io.github.makosdDavid/package-risk؟

ينشره makosdDavid. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.