pkgpulse-mcp

MCP server that gives an AI coding agent dependency intelligence before it runs npm install — package health scores, typosquat/hallucination checks, and whole-package.json audits. Paid per call in USDC on Base via x402; no API key, no signup.

Why

When an agent adds a dependency it usually can't tell whether the package is abandoned, deprecated, typosquat bait, runs code at install time, or even exists. request still gets 14M downloads a week and is deprecated. A hallucinated package name is one npm install away from executing a squatter's postinstall script. pkgpulse answers those questions for a fraction of a cent, and every score ships with the full rubric so the agent can re-derive it.

Tools

| Tool | Price | What it does | |---|---|---| | list_products | free | List all endpoints + prices | | get_sample | free | A real express health report — see the exact paid shape | | check_package_health | $0.005 | 0-100 health score with disclosed rubric + verdict | | check_typosquat | $0.003 | Is this name imitating a popular package? Risk-graded | | pick_package | $0.01 | Rank 2-5 candidates, quantified recommendation | | audit_dependencies | $0.02 | Audit a whole package.json (≤40 deps) |

Install

npx pkgpulse-mcp

Or add it to your MCP client config (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "pkgpulse": {
      "command": "npx",
      "args": ["pkgpulse-mcp"],
      "env": { "EVM_PRIVATE_KEY": "0xYOUR_BASE_WALLET_KEY" }
    }
  }
}

Paying

The two free tools work with no configuration. Paid tools need a Base wallet with a little USDC:

1. Set EVM_PRIVATE_KEY to a Base wallet private key (0x…). Use a small dedicated wallet, not your main one.
2. Fund it with a few dollars of USDC on Base (calls cost $0.003–$0.02).
3. Restart the MCP server.

Without a key, paid tools return setup instructions instead of failing.

Notes

• Registry-metadata analysis, not a code audit or vulnerability scan. Sources: npm registry, npm downloads API, GitHub public API.
• Point it at a different backend with PKGPULSE_BASE_URL.
• MIT licensed. Backend: https://pkgpulse.letom1176.workers.dev