io.github.hxckya/pkgtruth MCP Server

io.github.hxckya/pkgtruth

Repository Registry

What is the io.github.hxckya/pkgtruth MCP server?

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

How to install io.github.hxckya/pkgtruth

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

Environment / auth

PKGTRUTH_REGISTRY
Alternate npm registry to verify against. Defaults to https://registry.npmjs.org.
PKGTRUTH_DOWNLOADS_API
Alternate downloads API used for adoption figures. Defaults to https://api.npmjs.org.
PKGTRUTH_CACHE_DIR
Where adoption figures are cached between runs. Defaults to ~/.cache/pkgtruth.
PKGTRUTH_TIMEOUT_MS
Per-request timeout in milliseconds. Defaults to 8000.

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "pkgtruth": {
      "command": "npx",
      "args": [
        "-y",
        "pkgtruth"
      ],
      "env": {
        "PKGTRUTH_REGISTRY": "<YOUR_PKGTRUTH_REGISTRY>",
        "PKGTRUTH_DOWNLOADS_API": "<YOUR_PKGTRUTH_DOWNLOADS_API>",
        "PKGTRUTH_CACHE_DIR": "<YOUR_PKGTRUTH_CACHE_DIR>",
        "PKGTRUTH_TIMEOUT_MS": "<YOUR_PKGTRUTH_TIMEOUT_MS>"
      }
    }
  }
}