エージェントを強化
公開元自身の URL です。PlugMCP のエンドポイントではありません。
キーとログ付きでコピーをホスト。
https://mcp.pkgxray.ca/mcp上の Claude ボタンを押すと、名前と URL が入力された状態で Claude が開きます。確定の操作は Claude 側で行います。
claude mcp add --transport http adamsjack711-ux-pkgxray https://mcp.pkgxray.ca/mcpRun in a terminal.
{ "mcpServers": { "adamsjack711-ux-pkgxray": { "command": "npx", "args": [ "-y", "mcp-remote", "https://mcp.pkgxray.ca/mcp" ] } }}claude_desktop_config.json
リモート URL か、手元のマシンのコマンドか 2 つのインストール方法の違い
PlugMCP で実行
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
起動公開元より
Inspect an npm package or MCP server before you install it or connect to it.
You get a SAFE, REVIEW, or BLOCK verdict, decided by fixed rules and backed
by cited evidence. The analysis is static and runs on your machine without
installing npm dependencies. A pinned MIT-licensed Acorn parser is bundled. Normal scans never execute package code.
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
Real runs: guard clears [email protected], then blocks a sample modeled on the 2024 @solana/web3.js compromise.
pkgxray install scans the npm lockfile, installs held archives offline with scripts disabled, and verifies the resulting files.1. Quick start · 2. What it scans & detects · 3. Verdicts · 4. Usage · 5. Integrations · 6. How it compares · 7. Documentation
AI coding assistants install packages and connect to MCP servers quickly, and
often no person reads the code first. Sonatype counted more than 454,600 new
malicious open-source packages across monitored ecosystems in 2025, over 99% of
them on npm
(Sonatype).
npm audit asks whether a package has a known CVE. pkgxray also asks what the
code does, before anything installs.
1. Scan a known-benign package (no install of pkgxray needed):
npx --yes [email protected] guard npm:[email protected]
It stages the tarball in quarantine and runs the static and supply-chain checks.
There is no npm install, no lifecycle script, and no package code executed.
Decision: SAFE Grade: A+ (99/100)
No high- or medium-risk indicators were found in the provided evidence.
Notes:
- INFO npm-vs-github-clean — npm tarball matches the linked GitHub repo at the
published version. (15/16 files match GitHub @4.21.0)
2. Read the verdict:
SAFE is not a proof that a package is harmless; static analysis cannot see a
payload downloaded only at runtime. See the threat model.
3. See a BLOCK on the supplied inert fixture:
npx --yes [email protected] --file examples/onboarding-malicious.json --format markdown
The fixture is inert source text that models a split-string SSH-key read and
exfiltration. It is never executed. It returns BLOCK (exit 2) with the
cited file and evidence.
4. Add it to your workflow — rechecks & CI, MCP, Hookshot install gate.
Two execution models. Default
guardandauditscans are static, so package code is never executed. Three surfaces are different: listing an MCP server's tools may spawn it,mcp-proxyruns it behind a gate, and the opt-incanaryexecutes the package in a sandbox to confirm what it does. The canary can confirm that a package is malicious, but it can never prove one is safe. Full boundary: SECURITY.md.
Scans — pkgxray guard npm:name@version or pypi:name@version,
github:owner/repo, a local directory, whole lockfiles across two ecosystems
(npm: package-lock.json, yarn.lock, pnpm-lock.yaml, package.json; PyPI:
requirements.txt, poetry.lock, Pipfile.lock, pyproject.toml), MCP
servers, and AI-agent extensions.
Detects — credential theft (incl. split-fragment paths), cloud
instance-metadata and secret-store harvesting, prompt injection, Unicode
smuggling, base64 payloads and stage-2 loaders, exfiltration, persistence
(shell profile, OS scheduler, and injected CI/CD workflows), self-deleting
droppers, registry worm replication (install-time npm publish), npm
install-hook and PyPI setup.py install-time execution, obfuscated computed-arg
execution, hallucinated / slopsquat names (a lockfile pin the registry never
published), known CVEs (via OSV, before download), npm↔GitHub artifact
divergence, trojaned updates (recheck), and MCP
capability-surface abuse.
The full coverage matrix is in the threat model, along with the known blind spot: a package that downloads its payload later. A side-by-side comparison table is on the website.
Exit codes are stable and CI-friendly: 0 safe/allow · 2 block ·
3 review.
pkgxray guard npm:[email protected] [--format json] # vet a package before install
pkgxray guard pypi:[email protected] # same, for a PyPI package (sdist staged + scanned)
pkgxray mcp --package npm:[email protected] npx some-mcp-server # vet an MCP server; --recheck catches the rug-pull
pkgxray audit package-lock.json [--deep-all] # also: yarn.lock, pnpm-lock.yaml, package.json
pkgxray audit requirements.txt [--deep] # PyPI: also poetry.lock, Pipfile.lock, pyproject.toml
pkgxray recheck package-lock.json # scheduled: non-zero only on a regression
audit checks resolved dependencies against OSV. --deep adds source scans for
blocked dependencies; --deep-all requests source scans for all resolved dependencies.
Failed deep scans and incomplete source collection return REVIEW unless already BLOCK.
guard --deps includes direct-dependency findings in its decision; only exact pins
are checked, with ranges and other unresolved sources left at REVIEW. Guard output
lists completed, partial, disabled and failed checks so a passing verdict does not
imply checks that never ran.
PyPI scans cover source-distribution manifests, vulnerability metadata, and text-level
injection checks; they do not provide full Python module behavioral analysis or wheel inspection.
Python source adds an unsupported-behavior REVIEW finding. Behavioral coverage gaps
cannot be muted or promoted with allow-review; a pinned artifact approval remains
an explicit operator override. Archives containing links or special files are rejected.
One optional .pkgxray.json tunes policy on the Node-based surfaces. The browser
extension scans supplied evidence using engine defaults and cannot read project configuration. No config
means the strictest settings. Config can never allow a CVE away, every loosening
is printed, and a scan that errors fails closed to review. Schema and rules:
configuration.md · .pkgxray.example.json.
One engine behind every entry point. "Works with" means a documented setup guide, not a vendor-endorsed integration.
npm audit and OSV-Scanner check for published CVEs, and pkgxray does not
replace them. Run it alongside them. The tools in the same lane are Socket.dev,
OpenSSF Package Analysis, and Cisco MCP Scanner, which also analyze what package
code does. The full capability comparison is in
docs/comparison.md and on the
website.
Historical top-1000 runs and their scope and methodology remain available at pkgxray.ca/stats. Those results predate the parser-based flow engine and have not been rerun for this change. The current engine passes all 270 internal synthetic calibration/challenge fixtures without a malicious SAFE or benign BLOCK; many malicious cases produce REVIEW. This is regression evidence, not a real-world detection-rate estimate.
Start at the documentation index.
npm test # zero-dep node --test suite
npm run benchmark # calibration corpus: precision/recall + 0-false-block gate
npm run validate:website # regenerate + validate the calibration pages
Pull requests are welcome. Read CONTRIBUTING.md and the Code of Conduct first. Report vulnerabilities privately, as SECURITY.md describes. Releases publish to npm with provenance (SLSA attestation), and each one is gated on the tests, the calibration benchmark, and pkgxray's own supply-chain guard.
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
{ "mcpServers": { "adamsjack711-ux-pkgxray": { "url": "https://mcp.pkgxray.ca/mcp", "headers": {} } }}ツール
ツール一覧はまだありません。リモートサーバーは、最初のヘルスチェック後に取得されます。
よくある質問
このページで Cursor、Claude Desktop、Claude Code、VS Code 用の http 設定をコピーできます。PlugMCP のプロキシではなく、公開元のインストール方法を使います。
このレコードに必須の環境変数は記載されていません。
Pkgxray には HTTP で接続します。
最終チェックは 2026-11-05 です。 Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.