Presend dependency checks

Presend — Free Privacy Tools, a Security API, and an MCP Server for AI Agents

Presend checks npm and PyPI packages before they are installed: typosquats, known vulnerabilities of the version you use, publisher changes (npm), and names that do not exist or were first published in the last 30 days. It is available as a free API, an MCP server for AI agents and a GitHub Action. The site also has free browser tools; the file tools process files locally.

Open Presend · API docs · OpenAPI spec · MCP server · Measurements · For teams

Why Presend?

• Before an agent installs a package -- the MCP tool supply_chain_check reports package_not_found for a name that does not exist on npm or PyPI (it may be invented by a model) and new_package for one first published less than 30 days ago.
• Measured false alarms -- the typosquat check is measured on the most downloaded PyPI packages and the npm-high-impact list, with the scripts to reproduce it: see the measurements page.
• Real supply-chain signal (API) -- maintainer-change-check flags a package recently taken over by a previously unseen publisher after a long dormancy (the event-stream pattern; it does not detect hijacked existing accounts).
• What it is not -- not a malware scanner: it reports signals worth a look before installing, it does not analyse package code.
• No account -- the API and the MCP server are free, with no signup and no key; per-minute rate limits apply. A paid offer for teams is being tested: Presend for teams.
• Browser file tools -- the file tools (EXIF, PDF, images, office files) run locally with Web Crypto, Canvas and FileReader. A few other tools rely on a network service (speech recognition, password breach lookup, link preview...); the privacy page lists each one.
• PWA -- install on mobile or desktop.

API & MCP Server

• REST API -- free endpoints: supply-chain checks (typosquat, vulnerabilities of a given version, maintainer change, repository health, and a combined supply-chain check), DNS and WHOIS lookups, email checks, JWT decode and verify, file and image processing, and everyday utilities. Full OpenAPI 3.0 spec.
• MCP server -- the same checks as tools over Streamable HTTP, no signup, no key; listed in the official MCP registry as io.github.presendapp/presend-mcp.
• npm client -- npm install presend-api, zero-dependency.
• GitHub Action -- checks the dependencies of package.json or requirements.txt in CI (npm and PyPI).
• Code examples -- working Python for LangChain, CrewAI, LlamaIndex, OpenAI Agents SDK, Google ADK, and plain REST.
• MCP config guides -- copy-paste setup for Claude Desktop, Claude Code, Cursor, and Windsurf, no code required.
• Browser extension -- "Presend — Clean Photos", strips EXIF/GPS on right-click.

Python: Cloudflare rejects the default urllib User-Agent (Python-urllib/3.x) with 403 error code: 1010. Set an explicit one, e.g. urllib.request.Request(url, headers={"User-Agent": "my-app/1.0"}). requests, curl and Node are not affected.

Browser Tools (48 total, 22 shown below)

SEO and Performance

Presend is built for search engines and AI assistants:

• Schema.org: structured data on the pages (Organization, FAQPage, BreadcrumbList...)
• Sitemap: a static sitemap.xml covering the tools, blog and guides in 8 languages
• Dynamic OG Images: API generates social preview images per tool
• Core Web Vitals: Preconnect, DNS-prefetch, CSS preload, zero render-blocking JS
• PWA: Service worker + manifest for offline use and installability
• Privacy-First Analytics: Cloudflare Web Analytics (no cookies, no IP tracking)

Embed on Your Site

Add a Presend tool to your website or link back to us:

See all embed options

Tech Stack

• Frontend: Vanilla HTML5, CSS3, ES6 (zero build step)
• Hosting: Cloudflare Pages (200+ edge locations)
• APIs: Cloudflare Workers (share links, analytics, sitemap, OG images)
• Storage: Cloudflare KV (share links, 30-day TTL)
• PWA: Service Worker + Web App Manifest

License

MIT — free to use, modify, and embed.

Open Presend