{
  "markdown": "# package-risk MCP connector\n\nMCP tools for checking a package's maintenance status, licence, and security\nadvisories before you depend on it - `package_risk`, `package_licence`,\n`package_advisories`. Paid per call in USDC on Base mainnet via [x402](https://x402.org).\n\n**No subscription, no API key.** You pay from your own wallet, per call, only\nfor what you use.\n\n## What this is (and isn't)\n\nThis is a thin client. The actual service is a stateless HTTP API at\n`x402-package-risk.x402-package-risk.workers.dev`. This connector never sees,\nholds, or forwards anyone else's funds - it only ever spends the wallet key\n**you** configure below, and only when **you** call one of its tools.\n\n## Setup\n\nYou need an EVM wallet with a small amount of USDC on **Base mainnet**\n(calls cost $0.005-$0.01 each). Never use a wallet holding significant funds\nfor an automated agent key - keep this one funded lightly.\n\nAdd to your MCP client config (Claude Desktop, Claude Code, Cursor, etc.):\n\n```json\n{\n  \"mcpServers\": {\n    \"package-risk\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@makosdav/package-risk-mcp\"],\n      \"env\": {\n        \"EVM_PRIVATE_KEY\": \"0xyour-private-key-here\"\n      }\n    }\n  }\n}\n```\n\n## Tools\n\n| Tool | Price | What it returns |\n|---|---|---|\n| `package_risk` | $0.01 | Full verdict: maintenance, licence, advisories, deprecation |\n| `package_licence` | $0.005 | Licence expression and closed-source safety |\n| `package_advisories` | $0.005 | Open OSV advisories for the resolved version |\n\nAll three take `system` (npm/pypi/go/maven/cargo/nuget), `name`, and an\noptional `version`.\n\n## How payment works\n\n1. Your agent calls a tool.\n2. This connector requests the resource; the server replies `402 Payment Required`.\n3. `@x402/fetch` builds and signs a payment authorisation with your key.\n4. The request retries with payment attached; the server verifies via Coinbase\n   CDP, returns the result, and settles on-chain.\n\nNo approval prompt happens here beyond what your MCP client itself asks for -\nif you want per-call confirmation, configure that in your agent framework, not\nhere.\n",
  "bytes": 2103,
  "sha": "8d3ab3e4a41008206809cf6cce938956775f422375e2f1519c3bcc668c7d4830",
  "repo_slug": "makosddavid/package-risk-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_makosddavid_package_risk_2d943c9e/readme"
}