pkgxray

Overview

pkgxray is a Model Context Protocol server that runs security scans on npm packages, MCP servers, and AI agents before installation, providing cited verdict evidence for each finding. By speaking MCP, it lets AI assistants call pkgxray as a tool instead of requiring manual steps between applications.

The server runs locally on your machine via npx -y pkgxray, using the npm package pkgxray to speak MCP over stdio. No authentication is needed—it works immediately after installation. The latest release is v1.0.5 under MIT license, with source code available at adamsjack711-ux/pkgxray on GitHub.

pkgxray belongs in the AI & Agents category on mcp.site and works with any MCP client including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed. If you maintain pkgxray, claim this listing to verify ownership and keep its information up to date.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "pkgxray": {
      "command": "npx",
      "args": [
        "-y",
        "pkgxray"
      ]
    }
  }
}