Power your agent
Yayıncının kendi komutu. PlugMCP uç noktası değildir.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code'un yerel komutlar için kurulum bağlantısı yok. Aşağıdaki komutu kopyalayın ve bir terminalde çalıştırın.
claude mcp add package-intel-mcp -- npx -y package-intel-mcp@1.1.2Bir terminalde çalıştırın.
{ "mcpServers": { "package-intel-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
Uzak URL mi, yoksa makinenizde bir komut mu? İki kurulum arasındaki fark
PlugMCP’de çalıştır
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
BaşlatYayıncıdan
A pay-per-call API selling npm, PyPI and crates.io (Rust) package health, dependency-graph, and vulnerability data to AI coding agents over the x402 payment protocol — plus an MCP server so agents in Claude Desktop/Cursor can call it and pay automatically.
MCP server giving coding agents npm, PyPI and crates.io package health, vulnerability, dependency-graph and download data. Free and zero-config; an optional wallet or a USDC transaction hash unlocks paid consolidated risk scores over x402.
Defaults to Base Sepolia testnet via the free public facilitator. Going to mainnet is an explicit config change (see Going to mainnet).
Raw passthrough of the upstream sources is free: npm, PyPI, crates.io, OSV and deps.dev are themselves free and unauthenticated, so charging for a relay of them prices against zero. What gets charged for is the consolidation — the score.
:ecosystem is npm, pypi or crates. Also unpaid: /healthz, /v1/sample (canned
example response), /.well-known/x402 (discovery manifest).
Free routes are rate limited to 60/min and 2000/day per caller — a runaway agent loop
is how we would get our egress IP blocked by npm or OSV. Paid routes are exempt; their
price is the limiter. Exceeding a limit returns 429 with Retry-After.
Tier, price, description, and discovery metadata all come from src/catalog.ts — edit
there and the payment middleware, rate limiter, manifest, and Bazaar declarations stay in
sync. tier is a required discriminant, so a new endpoint cannot default into being free.
The rate limiter counts per client IP, but the service sits behind a Worker proxy and a
tunnel, so every request arrives from the same address. The proxy forwards the real one as
x-stable-ip signed with PROXY_SECRET, and the origin honours it only when the
secret matches. Anything else — wrong secret, no secret, or a request straight to the
tunnel hostname — shares a single bucket. Without that signature a caller could forge a
fresh address per request, or skip the proxy, and get unmetered upstream fan-out.
Set the same value in both places:
# .env for the origin, plus:
npx wrangler secret put PROXY_SECRET
The server warns at startup if it is missing on mainnet.
npm install
npm run gen-wallet
gen-wallet prints two testnet-only keypairs — never fund these with real assets:
.env as PAY_TO (where payments land)..env as BUYER_PRIVATE_KEY (used by the test
script to simulate a paying agent).Copy .env.example to .env and fill those in. Then fund the buyer with Base Sepolia
USDC at faucet.circle.com (select Base Sepolia; no account
needed). No testnet ETH is required — x402's exact scheme uses EIP-3009, so the buyer
only signs off-chain and the facilitator pays gas.
npm run dev
Verify: curl http://localhost:4021/healthz → 200, and
curl -i http://localhost:4021/v1/health/npm/express → 402 with payment instructions.
npm run test-buyer # GET /v1/health/npm/express (default)
npm run test-buyer -- /v1/deps/npm/express
npm run test-buyer -- /v1/batch
On Git Bash/Windows, prefix with MSYS_NO_PATHCONV=1 so the leading / isn't rewritten
into a Windows path.
A request for a nonexistent package returns 404 without charging — the x402 middleware skips settlement entirely on any 4xx/5xx response, so failures are free.
mcp-client/ is a standalone npm package (package-intel-mcp) — a stdio MCP server that
runs on the buyer's machine. It is published separately from this server so an install
does not drag in Hono and the x402 server stack; it imports nothing from src/.
It runs with no configuration at all. With no wallet it registers the four free tools
(package_snapshot, package_vulns, package_deps, package_downloads). Requiring a
funded hot wallet before the tool did anything was the single biggest adoption blocker, so
that is now the default path, not an error.
claude mcp add package-intel -- npx -y package-intel-mcp
Setting X402_PRIVATE_KEY additionally registers package_health and
package_batch_health, which call the paid endpoints and, on a 402, sign a USDC payment
from that wallet and retry — the agent just sees data. A malformed key is a hard error
rather than a silent drop back to free mode, since that would look like the paid tools
vanishing for no reason.
{
"mcpServers": {
"package-intel": {
"command": "npx",
"args": ["-y", "package-intel-mcp"],
"env": { "X402_PRIVATE_KEY": "0x..." }
}
}
}
X402_PRIVATE_KEY is the agent operator's wallet, funded with USDC on NETWORK. Use a
dedicated low-balance wallet — it is a hot key that spends automatically.
To run it from source against a local server: npm run mcp.
Installing a tool does not make an agent reach for it. A line in the consuming repo's
AGENTS.md / CLAUDE.md / .cursor/rules does, on every relevant task — that is the
mechanism that produces recurring invocation, not registry listings. mcp-client/README.md
ships a copy-paste block for this.
action.yml publishes this repository as a dependency-review action. On a pull request that
touches package.json, requirements*.txt or Cargo.toml, it looks up every newly added
dependency and comments with advisories, deprecation, staleness and missing licences.
name: Dependency review
on:
pull_request:
paths: ["**/package.json", "**/requirements*.txt", "**/Cargo.toml"]
permissions:
contents: read
pull-requests: write
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # needed: the action diffs base against head
- uses: adam121393/package-intel@v1
with:
fail-on: critical # none | low | moderate | high | critical
Uses the free endpoints only — no wallet, no API key, no signup. Zero runtime dependencies, so adding it to a pipeline is not a supply-chain ask.
Two behaviours worth knowing. Only added dependencies are reviewed, not version bumps of
existing ones, so the comment does not become noise people learn to scroll past. And advisories
are scoped to a version: an exact pin is checked as written, while a range is checked against the
package's current release. That distinction matters — querying without a version returns every
advisory ever filed, which reports a fully patched lodash as critical.
A dependency that cannot be looked up is never a failure. An upstream outage must not block an unrelated pull request.
Two different CDP credentials, easy to conflate:
Receiving payments needs only a public address. The server never holds key material to
get paid — CDP_WALLET_SECRET is only for npm run cdp-wallet.
# 1. Add CDP_API_KEY_ID + CDP_API_KEY_SECRET to .env, then:
npm run cdp-check # verifies keys, prints which networks CDP actually serves
# 2. Add CDP_WALLET_SECRET, then create a TEE-backed receiving account:
npm run cdp-wallet # prints an address to use as PAY_TO
npm run cdp-wallet -- --faucet # also request Base Sepolia test funds
cdp-check exists because CDP's docs list supported networks as "Base, Polygon, Arbitrum,
World, Solana" without saying whether Base Sepolia is included, and /supported requires
auth. It answers that empirically and tells you whether the testnet rehearsal below is
possible.
If cdp-check reports Base Sepolia is supported, set USE_CDP_FACILITATOR=true while
leaving NETWORK=eip155:84532. You then exercise the real CDP credentials and settlement
path against test funds. If it isn't supported, leave the flag unset — the CDP path
will first run on mainnet, so make that first payment a small one.
npm run cdp-wallet), never
a personal wallet. Only the public address goes in PAY_TO.NETWORK=eip155:8453. The server switches to the CDP facilitator automatically
and refuses to boot without CDP keys, rather than silently using a testnet facilitator.PUBLIC_URL to the real origin so the manifest advertises reachable URLs.Start small and confirm settlement on BaseScan against your PAY_TO
address before promoting the endpoint anywhere.
railway.json is included (Nixpacks, npm run start:api, /healthz health check). Push the repo,
create a Railway project from it, and set the environment variables from .env.example in
Railway's variables UI — not in a committed file. Point uptime monitoring at /healthz.
npm/express); this matters because the Bazaar probes with that input and only
indexes endpoints that answer 402 — a placeholder ecosystem would 400 and never list./.well-known/x402 — already served, for agentic.market / x402scan / x402-list.stale: true rather than erroring.src/domain/health.ts is a documented v1 heuristic — tune the weights
as real usage data arrives.MCP server giving coding agents npm, PyPI and crates.io package health, vulnerability, dependency-graph and download data. Free and zero-config; an optional wallet or a USDC transaction hash unlocks p
{ "mcpServers": { "package-intel-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}Genel bakış
MCP server giving coding agents npm, PyPI and crates.io package health, vulnerability, dependency-graph and download data. Free and zero-config; an optional wallet or a USDC transaction hash unlocks paid consolidated risk scores over x402.
Araçlar
Henüz araç listesi yok. Uzak sunucular ilk sağlık kontrolünden sonra bir liste alır.
SSS
Bu sayfadan Cursor, Claude Desktop, Claude Code veya VS Code için stdio yapılandırmasını kopyalayın. PlugMCP proxy'sini değil, yayıncının kurulumunu kullanır.
Bu kayıtta gerekli bir ortam değişkeni listelenmiyor.
Package Intel yerel olarak stdio üzerinden çalışır.
Son kontrol: 2026-11-14. MCP server giving coding agents npm, PyPI and crates.io package health, vulnerability, dependency-graph and download data. Free and zero-config; an optional wallet or a USDC transaction hash unlocks paid consolidated risk scores over x402.