pkgtruth
Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.
Install
npmstdio
npx -y pkgtruth Client config (Claude Desktop, Cursor, Windsurf and most MCP clients)
{
"mcpServers": {
"io-github-hxckya-pkgtruth": {
"command": "npx",
"args": [
"-y",
"pkgtruth"
]
}
}
}Source: official MCP Registry record · registry name io.github.hxckya/pkgtruth · published 2026-09-10 · updated 2026-09-10. Not an endorsement; review the code before connecting it to anything sensitive.