# Who publishes your tool's packages?

Check the publisher, maintainers, repository and domains. Watch passes include continuing collection and change history.

Agentalog · Updated 2026-11-07

## Step 1. Check the tool before installing

Open Dependencies on the listing. The free lookup combines declared packages and repositories, cached public evidence and dated repository state. It does not install or execute the package. In the API, read GET /api/listings/:id/dependencies. In MCP, use listing_dependencies.

## Step 2. Distinguish declarations from identity evidence

On npm, the version publisher and current maintainers are distinct facts. On PyPI, author and maintainer fields are declarations. When file provenance exists, we collect its public publisher and workflow information. We do not independently verify cryptographic signatures. Each observation gives its source, date and coverage; missing evidence stays unknown.

## Step 3. Keep checking after the conversation

Add the tool to your watchlist and enable dependency checks with a single-slot, Team or Business pass. The existing pass includes chain collection, before/after comparison and notices of package, publisher, maintainer, repository and domain changes. Sources enter the refresh queue every six hours, subject to upstream quotas. Use watch_dependency_changes and read dependency_changes in MCP. Activation requires the pass and never buys another automatically.

## Step 4. Turn a notice into action

History shows the changed fact, its previous value, its new value and the source. When the registry publishes a date, domain reminders use 30, 15 and 7 days before expiry. Check with the operator, then renew or replace the dependency when needed. An expired domain does not prove account takeover. Accounts receive operational notices; wallet owners read API history. Suggested alternatives carry their own evidence and are not automatic replacements. We have not measured token savings for an equivalent task.

## Step 5. Read the original sources

Metadata: https://github.com/npm/registry/blob/main/docs/REGISTRY-API.md, https://docs.pypi.org/api/json/ and https://docs.pypi.org/api/integrity/. Repositories: https://docs.github.com/en/rest/repos/repos and https://docs.gitlab.com/api/projects/. Domain registration: https://www.iana.org/rdap. These sources support the facts shown; they do not guarantee that every tool publishes every field.

[Find a tool](https://agentalog.com/)

[Who publishes your tool's packages?](https://agentalog.com/guides/package-publisher-watch)