# Packagephobia

> Packagephobia MCP — install-size analysis for npm packages

- name: io.github.pipeworx-io/packagephobia
- version: 0.1.2
- connection class: R0 (autonomous)
- trust: 97/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fpackagephobia
- tools: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fpackagephobia/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "packagephobia": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/packagephobia/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 99
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-96% +updated-24d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: unknown
- tools last changed: 2026-10-20T06:57:46.239Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.pipeworx-io/packagephobia.svg)](https://protogrid.dev/servers/io.github.pipeworx-io/packagephobia)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `pipeworx_feedback` removed
  - Tell the Pipeworx team something is broken, missing, or needs to exist. Use when a tool returns wrong/stale data (bug), when a tool you wish existed isn't in the catalog (feature/data_gap), or when something worked surprisingly well (praise). ONLY for tools served by this Pipeworx connection — if the tool came from a different MCP server in your client (another vendor's Gmail, Splunk, Slack, etc. connector), we cannot fix it and reporting it here only delays you; file it with that server instead. Not sure? Pipeworx tool names are the ones this connection lists. Describe the issue in terms of Pipeworx tools/packs — don't paste the end-user's prompt. Filing without an account returns a `claim_token`; pass it back later as pipeworx_feedback({claim_token:"pwfb_…"}) to read whether it was fixed and what changed. The team reads digests daily and signal directly affects roadmap. Rate-limited to 5 per identifier per day. Free; doesn't count against your tool-call quota.
- 2026-10-20 `ai_visibility_check` removed
  - Probe one or more LLMs for what they know about a business / brand / product / topic and score visibility (0-100) per model. Default model is Workers AI Llama-3.3-70b (free); pass `_apiKey` to also probe Anthropic (BYO key — you pay Anthropic directly for those calls). Returns per-model {score, confidence, signals, raw_response} + a combined view. Useful for AI-marketing audits, pre-launch brand checks, competitive monitoring.
- 2026-10-20 `suggest_questions` removed
  - What can I ask Pipeworx? / what is Pipeworx good for? / what can you do? / give me ideas / show me examples / getting started / what data do you have? — the onboarding entry point for an agent that just connected and wants to know what is worth asking. Returns category-bucketed example questions (company financials, drugs & clinical trials, economics, real estate, prediction markets, weather, government & patents, science & academia, news) — each with the exact tool + argument shape that answers it, drawn from the live catalog of thousands of tools. Call with no arguments for the full spread, or pass `topic` (e.g. "finance", "pharma", "betting") to focus. Use this FIRST when you do not yet know what Pipeworx can do for you, or to learn how to call the meta-tools (ask_pipeworx, entity_profile, compare_entities, etc.).
- 2026-10-20 `resolution_diff` removed
  - Field-by-field diff of TWO markets' settlement clauses (one from each of `a` and `b`; either can be Polymarket or Kalshi) — runs resolution_audit on both sides and compares source, settle time, precision, and evidence standard. Returns `equivalent`: "true" only when both sides parsed with enough confidence to compare AND no field conflicts; "false" when a specific conflict was found (differing_fields names which — e.g. ["source","settle_time"] for a Polymarket Bitcoin market settling on Binance's 1-minute candle at noon ET versus a Kalshi KXBTCD market settling on CF Benchmarks' BRTI 60-second average at 5pm EDT — SAME asset, DIFFERENT contract); "unclear" when one or both sides could not be confidently parsed (an absence of evidence is not evidence of equivalence — read raw_clause yourself in that case). Only flags a field as differing when BOTH sides gave a SPECIFIC comparable answer — a named source (e.g. "Associated Press, Fox News, NBC") against a generic one (e.g. Kalshi's "consensus of media organizations") is treated as the same evidence standard, not a conflict, since that is standard election-market boilerplate on both venues. Use this before sizing a polymarket_kalshi_spread pair as a real cross-venue arb, or standalone to sanity-check any two markets you suspect settle on different things.
- 2026-10-20 `polymarket_fill_risk` removed
  - Realizable-vs-theoretical edge check against live CLOB order-book depth. REQUIRES one of `market` (single-market mode) or `event` (basket/partition mode). SINGLE-MARKET: pass a market slug/URL + side (buy_yes|sell_yes|buy_no|sell_no, default buy_yes) + size_usd (default 1000 — max spend on buys, target proceeds on sells); walks the ladder and returns top_of_book, vwap_fill_price, slippage_pp, shares_filled, max_fillable_usd, and a verdict (clean|degraded|cannot_fill). BASKET: pass an event slug/URL + side (sell_yes = capture overround by selling every leg, buy_yes = capture underround; default auto from partition sum) + size_usd interpreted as settlement notional S (shares per leg; each share pays $1); returns theoretical_sum vs realizable_sum (top-of-book vs VWAP across all legs), capture_ratio, profit_usd at executed size, per-leg fill detail, thin_legs[], max_clean_notional_usd, and forced_directional_risk naming the legs most likely to strand you unhedged. USE THIS before acting on any polymarket_arbitrage SELL/BUY-EVERY-LEG signal or any polymarket_edges trade above ~$500 — theoretical overround on thin books is not capturable, and partial basket fills convert an arb into an unhedged directional position (the dominant loss mode in real arb-bot P&L). FEES ARE NOT MODELLED HERE: vwap_fill_price/profit_usd are GROSS of Polymarket's own taker fee (rate 0.04-0.07 by category — see polymarket_edges/fees.ts), on top of which this tool prices depth-crossing cost; a thin-margin fill that looks clean here can still be net-negative after the fee.
- 2026-10-20 `compare_entities` removed
  - "Compare X and Y" / "X vs Y" / "X versus Y" / "which is bigger / better / larger / more profitable" / "rank these companies" / "head to head" — side-by-side comparison of 2–5 companies or drugs in ONE parallel call. ALWAYS PREFER over sequential single-pack lookups when comparing entities. type="company" pulls LATEST 10-K revenue + net income + cash + long-term debt from SEC EDGAR/XBRL (off-calendar fiscal years handled correctly — AAPL Sep, NVDA Jan, etc.). type="drug" pulls FAERS adverse-event counts, FDA approval counts, active trial counts. Results sorted by primary metric so "largest" / "most" / "biggest" reads off the top of the response. Returns paired data + pipeworx:// citation URIs per entity. Replaces 8–15 sequential lookups.
- 2026-10-20 `forget` removed
  - Delete a previously stored memory by key. Use when context is stale, the task is done, or you want to clear sensitive data the agent saved earlier. Pair with remember and recall.
- 2026-10-20 `resolution_audit` removed
  - Extract the settlement clause of a single Polymarket or Kalshi market: who publishes the settling number (source), the clock time + timezone it is taken at, the precision of the computation (e.g. "1-minute candle close" vs "60-second trailing average" vs "election outcome"), the evidence standard (official_source | consensus_reporting | any_credible_report | unspecified), and void_handling (cancellation/postponement settlement — reused verbatim from bet_research's cancellation_rule detector, not re-derived). Parses Polymarket's `description` field (fetched via polymarket_market) or Kalshi's `rules_primary` + `rules_secondary` fields (fetched via kalshi_market) with regex + a small vocabulary — no LLM pass, so an unusual clause reports confidence:"low" rather than a guess. Pass `market` as a Polymarket slug/URL or a Kalshi market ticker (e.g. "KXBTCD-26SEP1317-T66999.99"); a Kalshi EVENT ticker (e.g. "KXBTCD-26SEP1317") also works — it picks one representative market under that event, since the settlement mechanism is normally shared across all strikes/legs in one event. Use this before treating a polymarket_kalshi_spread row as a real arbitrage: two ladders that look alike can settle on different sources, at different times, with different precision — this tool is how you check. Pair with resolution_diff to compare two markets directly. KNOWN GAP: idiosyncratic phrasing that doesn't match the vocabulary returns confidence:"low" and evidence_standard:"unspecified" rather than an LLM-guessed answer.
- 2026-10-20 `company_register_search` removed
  - Search the NATIONAL BUSINESS REGISTERS by company name and get the register's own id back — a Companies House number, a Norwegian organisasjonsnummer, a Finnish business id, a SIREN, a Japanese corporate number, an Estonian registry code, a CNPJ, or an LEI. Use this when you want the OFFICIAL REGISTERED ENTITY and the country is not the US, or when you do not know which country it is. Registers searched: Companies House (GB), Enhetsregisteret (NO), PRH/YTJ (FI), Sirene (FR), 法人番号公表サイト (JP), RIK e-Business Register (EE), and the GLEIF LEI crosswalk, which reaches jurisdictions we have no register pack for (DE, SE, AU, SG...). THIS TOOL REFUSES TO GUESS, and that is its point: when two different companies match a name equally well it answers `match_status: "ambiguous"` with BOTH, rather than naming one. A one-word trading name usually IS ambiguous — "Bolt", "Apple", "Next", "Sea", "DNB" each match a well-known group AND unrelated micro-entities whose registered name is exactly that word — so pass `country` when you know it. Every response names EVERY register it asked under `searched[]`, with that register's own as-of date and row count, and a register that could not be reached carries an `error` there rather than reading as zero rows: "we could not ask Companies House" is never the same answer as "this company is not in Britain". `related[]` holds entities that collapsed INTO the match — the same company seen through another register, or another country's arm sharing its LEI — so a multinational returns one answer rather than tying with itself. NOT A PEOPLE SEARCH: sole traders and other natural persons are excluded on the publisher's own legal-form field, never guessed from the shape of a name. For US public companies prefer resolve_entity (CIK + ticker + FIGI); the two share this same matcher, and resolve_entity returns these register fields too.
- 2026-10-20 `entity_profile` removed
  - "Tell me about X" / "research Acme" / "brief me on Tesla" / "what does Apple do" / "company profile for Microsoft" / "give me the rundown on NVDA" / "everything you know about $TICKER" — full cross-source profile of a US public company in ONE parallel call. ALWAYS PREFER over chaining single-pack SEC/XBRL/news lookups when the user asks for a holistic view. Fans out across SEC EDGAR, XBRL, USPTO patents, federal contracts (USAspending), FDA-licensed biologics (Purple Book), H-1B hiring (DOL LCA), news and GLEIF, and returns: cik + company_name (+ resolved_from/resolved_to when `value` was a name); recent_filings (up to 5 with pipeworx://edgar/company/{cik}/filings/{accession} URIs); fundamentals (the latest ANNUAL Revenues, NetIncomeLoss, Cash, diluted EPS, capex and operating cash flow, each with its period_end, SEC form and the accession of the filing it came from — plus EntityCommonStockSharesOutstanding, which is the newest COVER-PAGE share count the filer has published rather than an annual one, so its period_end is a cover date after the quarter closed and it is the right per-share denominator; a filer tagging a fallback concept appears under the name of that tag instead, e.g. PaymentsToAcquireProductiveAssets instead of PaymentsToAcquirePropertyPlantAndEquipment); patents (USPTO PatentsView API sunset May 2025 — soft-fails until reactivated); federal_contracts (USAspending awards where the company is the recipient); fda_products (FDA-licensed biologics — vaccines, cell/gene therapies — from the Purple Book; a company with only small-molecule/generic drugs will show none here, that is expected, not a failure); hiring (H-1B sponsorship volume + salary range from DOL LCA filings); recent news mentions via GDELT→GNews fallback; LEI via GLEIF. `sources_used` / `sources_failed` say which of these actually returned data for THIS company — an empty section is a real "no data", not a bug. `sources_skipped` is the third state: a leg we deliberately did NOT run, each entry carrying a `reason` token and a plain-English `detail` (the Purple Book is skipped for a filer SEC classifies outside the life-science SIC bands, since it lists only 351(a)/(k) biologics licence holders). Pass a ticker ("AAPL"), zero-padded CIK ("0000320193"), OR a company name ("Moderna") — names now resolve via SEC EDGAR's company-name match; a private company (no CIK/ticker) returns resolved:false with an explicit `notes` line, not a bare failure. `type` accepts "company" or "ticker" interchangeably — both take the same `value` shapes above.

Full history: https://api.protogrid.dev/v1/servers/io.github.pipeworx-io%2Fpackagephobia/changes

## Remotes

- https://gateway.pipeworx.io/packagephobia/mcp (streamable-http, auth none, reachable true, uptime30d 0.96460176)

## Packages

_none_

## Tools (0)

_none observed_