pkgproof

net.pkgproof/pkgproof

Verify an npm or PyPI package before install: advisories, install scripts, typosquats, repository.

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "pkgproof": {
      "command": "npx",
      "args": [
        "-y",
        "@pkgproof/mcp@0.2.1"
      ],
      "env": {
        "PKGPROOF_ALGORAND_PRIVATE_KEY": "<your PKGPROOF_ALGORAND_PRIVATE_KEY>",
        "PKGPROOF_BASE_PRIVATE_KEY": "<your PKGPROOF_BASE_PRIVATE_KEY>"
      }
    }
  }
}
Environment variables
  • PKGPROOF_ALGORAND_PRIVATE_KEYsecretBase64 account key of a throwaway Algorand wallet holding USDC (ASA 31566704) on Algorand Mainnet. Not a 25-word mnemonic. Optional: the first verification each day is free without any key. This is the rail payments prefer.
  • PKGPROOF_BASE_PRIVATE_KEYsecret0x-prefixed private key of a throwaway EVM wallet holding USDC on Base. Optional, and only used when no Algorand key is configured. Needs no ETH: payment is an off-chain signature and the facilitator pays the gas.

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Other
Version
0.2.1
Registry
active
Published
10/15/2026
Browse all Other →

Add the badge to your site

Show visitors that pkgproof is listed here — it’s also the link we check for a free listing.

pkgproof — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/net-pkgproof-pkgproof?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="pkgproof — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![pkgproof — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/net-pkgproof-pkgproof?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.