pkgxray — Claude Code MCP server: what it does, how to install
pkgxray checks npm packages, MCP servers, and AI-agent extensions before installation or connection. It returns a cited security verdict.
claude mcp add pkgxray -- npx -y pkgxrayWhat pkgxray does
pkgxray performs local static analysis and assigns SAFE, REVIEW, or BLOCK. Its checks cover credential theft, prompt injection, data exfiltration, install-time scripts, npm-to-GitHub artifact mismatches, and other suspicious package behavior. Findings point to the relevant file and supporting evidence.
Regular scans treat the archive as bytes, so package code is not run. The tool does not install npm dependencies for analysis and includes a pinned Acorn parser for JavaScript. It can inspect npm packages, MCP servers, AI-agent extensions, and lockfiles. The key limit is runtime delivery: a payload fetched later can escape static inspection, so SAFE is not proof that a package is harmless.
What it helps with
- check an npm package before installation
- screen an MCP server before connecting
- spot malicious install-time scripts
- compare an npm archive with its GitHub source
- flag suspicious entries in a lockfile
Example prompts for the agent
- Inspect
npm:[email protected]before installation and report the verdict with its evidence. - Scan this MCP server before I connect it and list the findings that need review.
- Audit the project lockfile and identify packages that require manual investigation.
How to install pkgxray
Platform CLI
claude mcp add pkgxray -- npx -y pkgxrayPlatform CLI
codex mcp add pkgxray -- npx -y pkgxrayConfig file
{
"mcpServers": {
"pkgxray": {
"command": "npx",
"args": [
"-y",
"pkgxray"
]
}
}
}Config file
{
"servers": {
"pkgxray": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"pkgxray"
]
}
}
}Platform CLI
gemini mcp add pkgxray npx -y pkgxrayStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about pkgxray
How do I install pkgxray in Claude Code?
Run claude mcp add pkgxray -- npx -y pkgxray. This adds the MCP server to Claude Code.
What does pkgxray do?
It statically examines npm packages, MCP servers, and AI-agent extensions before installation or connection. The result is SAFE, REVIEW, or BLOCK, with findings tied to files and evidence.
Does SAFE prove that a package is harmless?
No. Static analysis cannot see a payload that the package downloads later at runtime.
