# PkgGuard

> Dependency scan for agents: known CVEs and malicious packages via OSV.dev. By Crypto Money Maker

- name: co.youraitools/pkgguard
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 85/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/co.youraitools%2Fpkgguard
- tools: https://api.protogrid.dev/v1/servers/co.youraitools%2Fpkgguard/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "pkgguard": {
      "type": "http",
      "url": "https://api.youraitools.co/pkgguard/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-17d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 2 of 2 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: scan_dependencies (destructiveHint); check_package (destructiveHint)
- pass `tools.token_cost`: about 431 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: 2 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: deps.dev does not know @agentgate-builder/pkgguard@0.1.1

- tools: 2, about 431 tokens to load them all
- tool set hash: b514b7aec2d5fd3f80eb466106b95549
- tools last changed: 2026-10-23T21:02:00.114Z
- badge: [![protogrid quality](https://protogrid.dev/badge/co.youraitools/pkgguard.svg)](https://protogrid.dev/servers/co.youraitools/pkgguard)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-23 `check_package` changed (description)
  - before: Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev. Free preview tier: verdict and advisory count. The paid x402 endpoint /v1/package adds advisory ids, severity, CVSS and fixed-in versions.
  - after: Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev: advisory ids, severity, CVSS, fixed-in versions and malicious flags. Free tier: 30 calls/day per IP with full results, then $0.001 per call in USDC over x402 (/v1/package).
- 2026-10-23 `scan_dependencies` changed (description)
  - before: Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Free preview tier: verdict and counts, up to 25 packages. The paid x402 endpoint /v1/scan adds per-package advisory ids, severity, CVSS and fixed-in versions (up to 500 packages).
  - after: Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Returns per-package advisory ids (CVE/GHSA/MAL), severity, CVSS and fixed-in versions. Free tier: 30 calls/day per IP with full results, up to 100 packages; then $0.003 per scan (up to 500) in USDC over x402 (/v1/scan).

Full history: https://api.protogrid.dev/v1/servers/co.youraitools%2Fpkgguard/changes

## Dependencies

- npm @agentgate-builder/pkgguard@0.1.1: unknown

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.youraitools.co/pkgguard/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm @agentgate-builder/pkgguard@0.1.1

## Tools (2)

- `check_package`: Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev: advisory ids, severity, CVSS, fixed-in versions and malicious flags. Free tier: 30 calls/day per IP with full results, then $0.001 per call in USDC over x402 (/v1/package).
- `scan_dependencies`: Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Returns per-package advisory ids (CVE/GHSA/MAL), severity, CVSS and fixed-in versions. Free tier: 30 calls/day per IP with full results, up to 100 packages; then $0.003 per scan (up to 500) in USDC over x402 (/v1/scan).