Search / dev.blvkware/hallux
protogridR0· no sign-inCheck that a package, module or DOI exists before an agent installs, imports or cites it.
v0.1.0 · active · website · descriptor JSON · versions
{
"mcpServers": {
"hallux": {
"type": "http",
"url": "https://api.blvkware.dev/hallux/mcp"
}
}
}claude mcp add --transport http hallux https://api.blvkware.dev/hallux/mcp[mcp_servers.hallux]
url = "https://api.blvkware.dev/hallux/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"hallux": {
"type": "remote",
"url": "https://api.blvkware.dev/hallux/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"hallux": {
"type": "http",
"url": "https://api.blvkware.dev/hallux/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=hallux&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLmJsdmt3YXJlLmRldi9oYWxsdXgvbWNwIn0%3D"
}{
"servers": {
"hallux": {
"type": "http",
"url": "https://api.blvkware.dev/hallux/mcp"
}
}
}{
"mcpServers": {
"hallux": {
"httpUrl": "https://api.blvkware.dev/hallux/mcp"
}
}
}extensions:
"hallux":
enabled: true
name: "hallux"
type: streamable_http
uri: "https://api.blvkware.dev/hallux/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations4 of 4 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 1,137 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +website +reachable +uptime-100% +updated-26d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://api.blvkware.dev/hallux/mcp streamable-http | none | yes | 100% | 500 ms | 2025-11-25 | 2026-10-19 |
hallux_checkread-only | Does this identifier actually exist? Call before acting on any name you recalled rather than read: a package to install, a module to import, a DOI to cite. Returns one of: exists, deprecated, absent, phantom, squat, unknown. exists - proceed deprecated - proceed, but use `successor` absent - not in the registry. Do not proceed phantom - does not exist AND models repeatedly invent it. Do not proceed squat - was invented by models, then registered by someone. Treat as hostile unknown - could not verify. Never treat this as permission Live namespaces: cite.doi, pkg.crates, pkg.go, pkg.maven, pkg.npm, pkg.nuget, pkg.pypi. An unsupported namespace returns `unknown`, never an error, so it is safe to ask. |
hallux_check_commandread-only | Call this BEFORE running any command that installs a dependency: npm, yarn, pnpm, bun, pip, uv, poetry, pipx, cargo, go get, dotnet add package, nuget. Language models invent plausible package names that have never existed, and attackers register those names because they can predict them. Installing one runs attacker code. You cannot tell the difference by looking at the name, which is why this check exists. Pass the command exactly as you intend to run it. The identifiers are extracted for you. If the result says BLOCK, do not run the command. Use the `successor` if one is given, otherwise tell the user what was found and stop. |
hallux_check_manifestread-only | Call this after writing or editing a dependency file, and before committing it. Supported: package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod. Checks every dependency in one pass, including dev and optional groups, which is where an invented name usually arrives. |
hallux_watch | Register identifiers for notification when their verdict changes. The transition that matters is phantom to squat: a name models invent that somebody then registers. Use this for a dependency that came back `absent` or `phantom` and that the user intends to use anyway, or for a set of dependencies worth monitoring. Delivered by signed webhook to a URL you supply. |
Schemas: list_tools.
{
"name": "dev.blvkware/hallux",
"icons": [
{
"src": "https://blvkware.dev/assets/logo-192.png",
"sizes": [
"192x192"
],
"mimeType": "image/png"
}
],
"title": "HALLUX",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://api.blvkware.dev/hallux/mcp",
"type": "streamable-http"
}
],
"version": "0.1.0",
"websiteUrl": "https://blvkware.dev/hallux/",
"description": "Check that a package, module or DOI exists before an agent installs, imports or cites it."
}