MCP package check

The published facts about an npm package that ships an MCP server, read before running it: resolved version and publish date, package and version age, maintainer count, provenance attestation, install scripts (preinstall, install, postinstall; prepare listed apart), dependency, optional and bundled counts, declared binaries, deprecation, and the GitHub repository the manifest names (one keyless read: resolved name against the manifest, archived, fork, last push). Send POST /api/mcp-package-check with the required field package and pay $0.005 per call over x402 or MPP (there is no free tier). It returns a JSON object with package, requestedVersion, version, distTags, publishedAt and 19 more.

Accepts a name, name@version, or an npx command line. Observations only, each as a field plus a neutral sentence in signals; no score. A skipped read (oversize package document, GitHub rate limit) is named and the answer is marked partial.

Try in playground →

Parameters

Example request

curl -i -X POST https://agent402.tools/api/mcp-package-check \
  -H "Content-Type: application/json" \
  -d '{"package":"@modelcontextprotocol/server-filesystem"}'

Without payment this returns HTTP 402 Payment Required with the exact price for mcp-package-check; any x402 v2 or MPP client pays it and retries.

Example response

{
  "package": "@modelcontextprotocol/server-filesystem",
  "requestedVersion": "latest",
  "version": "2.0.0",
  "distTags": [
    "latest"
  ],
  "publishedAt": "2026-10-19T06:49:57.471Z",
  "versionAgeDays": 1,
  "createdAt": "2024-11-21T19:14:54.330Z",
  "packageAgeDays": 697,
  "versionCount": 21,
  "maintainers": {
    "count": 6,
    "names": [
      "jspahrsummers",
      "pcarleton",
      "fweinberger",
      "thedsp",
      "ochafik-ant",
      "cliffhall"
    ]
  },
  "provenance": {
    "attested": true,
    "predicateType": "https://slsa.dev/provenance/v1",
    "attestationsUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@modelcontextprotocol%2fserver-filesystem@2.0.0",
    "registrySignatures": 2,
    "integrity": "sha512-..."
  },
  "installScripts": {
    "present": false,
    "runOnInstall": [],
    "otherHooks": [
      "prepare"
    ]
  },
  "dependencies": {
    "runtime": 5,
    "optional": 0,
    "peer": 0,
    "bundled": []
  },
  "binaries": [
    "mcp-server-filesystem"
  ],
  "deprecated": null,
  "license": "SEE LICENSE IN LICENSE",
  "engines": {
    "node": ">=24"
  },
  "repository": {
    "declared": "git+https://github.com/modelcontextprotocol/servers.git",
    "directory": null,
    "github": "modelcontextprotocol/servers",
    "read": true,
    "matchesManifest": true,
    "resolvedName": "modelcontextprotocol/servers",
    "url": "https://github.com/modelcontextprotocol/servers",
    "archived": false,
    "fork": false,
    "disabled": false,
    "createdAt": "2024-11-19T01:10:17Z",
    "pushedAt": "2026-10-19T06:46:48Z",
    "stars": 91406,
    "defaultBranch": "main",
    "license": "Other"
  },
  "signals": [
    "version 2.0.0 published 1 day ago",
    "package first published 697 days ago, 21 versions",
    "6 maintainers",
    "provenance attestation present (https://slsa.dev/provenance/v1)",
    "no install script declared",
    "prepare script declared (runs for a git or local install, not a registry install)",
    "declares 1 binary: mcp-server-filesystem",
    "5 runtime dependencies, 0 optional",
    "GitHub repository matches the manifest"
  ],
  "reads": {
    "registry": "package document",
    "github": "read"
  },
  "skippedReads": [],
  "complete": true,
  "partial": false,
  "sources": [
    "registry.npmjs.org",
    "api.github.com"
  ]
}

From an MCP client

catalog.call {
  "slug": "mcp-package-check",
  "params": {
    "package": "@modelcontextprotocol/server-filesystem"
  }
}

The hosted connector at https://agent402.tools/mcp needs a payment for mcp-package-check; the stdio package pays it from a wallet or from an AGENT402_CREDITS_KEY issued earlier. Local install: npx -y agent402-mcp.

Errors and behavior

• package is required. An input the tool rejects returns an HTTP 4xx whose body carries error, tool, expected, required and example, so the caller can correct it.
• A paid call that ends in any status of 400 or above is not charged over x402, MPP or a prepaid credits key: settlement is canceled when the tool fails. The exception is a Tempo push credential, a transfer the buyer sent before the call: it settles before the tool runs, so if the tool then fails the payment is recorded as a refund owed to the paying wallet.
• Wallet-only: this tool reaches the network or stored state, so it has no proof-of-work tier. A prepaid card-credits key issued earlier (Authorization: Bearer a402_...) also pays it.
• A GET or HEAD to /api/mcp-package-check returns the same 402 quote, so the price can be read without a body.
• An Idempotency-Key header makes a retried paid call replay the first 200 instead of charging again (an answer larger than 1 MB is not replayed).

Paid call (JavaScript agent)

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
client.setSpendControls?.({ maxAmountPerPayment: "$0.005" }); // refuse any quote above this tool's price
registerExactEvmScheme(client, { signer: privateKeyToAccount(KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agent402.tools/api/mcp-package-check", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "package": "@modelcontextprotocol/server-filesystem"
  }),
});

Related tools