Who publishes your tool's packages?
Check the publisher, maintainers, repository and domains. Watch passes include continuing collection and change history.
Updated
1Check the tool before installing
Open Dependencies on the listing. The free lookup combines declared packages and repositories, cached public evidence and dated repository state. It does not install or execute the package. In the API, read GET /api/listings/:id/dependencies. In MCP, use listing_dependencies.
2Distinguish declarations from identity evidence
On npm, the version publisher and current maintainers are distinct facts. On PyPI, author and maintainer fields are declarations. When file provenance exists, we collect its public publisher and workflow information. We do not independently verify cryptographic signatures. Each observation gives its source, date and coverage; missing evidence stays unknown.
3Keep checking after the conversation
Add the tool to your watchlist and enable dependency checks with a single-slot, Team or Business pass. The existing pass includes chain collection, before/after comparison and notices of package, publisher, maintainer, repository and domain changes. Sources enter the refresh queue every six hours, subject to upstream quotas. Use watch_dependency_changes and read dependency_changes in MCP. Activation requires the pass and never buys another automatically.
4Turn a notice into action
History shows the changed fact, its previous value, its new value and the source. When the registry publishes a date, domain reminders use 30, 15 and 7 days before expiry. Check with the operator, then renew or replace the dependency when needed. An expired domain does not prove account takeover. Accounts receive operational notices; wallet owners read API history. Suggested alternatives carry their own evidence and are not automatic replacements. We have not measured token savings for an equivalent task.
5Read the original sources
Metadata: https://github.com/npm/registry/blob/main/docs/REGISTRY-API.md, https://docs.pypi.org/api/json/ and https://docs.pypi.org/api/integrity/. Repositories: https://docs.github.com/en/rest/repos/repos and https://docs.gitlab.com/api/projects/. Domain registration: https://www.iana.org/rdap. These sources support the facts shown; they do not guarantee that every tool publishes every field.