# pkgxray

pkgxray checks npm packages, MCP servers, and AI-agent extensions before installation or connection. It returns a cited security verdict.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 12
- Author: adamsjack711-ux
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/adamsjack711-ux/pkgxray
- Updated: 2026-10-15
- HTML: https://affpapa.org/en/nevibecode/mcp/pkgxray

## What it does

pkgxray performs local static analysis and assigns `SAFE`, `REVIEW`, or `BLOCK`. Its checks cover credential theft, prompt injection, data exfiltration, install-time scripts, npm-to-GitHub artifact mismatches, and other suspicious package behavior. Findings point to the relevant file and supporting evidence.

Regular scans treat the archive as bytes, so package code is not run. The tool does not install npm dependencies for analysis and includes a pinned Acorn parser for JavaScript. It can inspect npm packages, MCP servers, AI-agent extensions, and lockfiles. The key limit is runtime delivery: a payload fetched later can escape static inspection, so `SAFE` is not proof that a package is harmless.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add pkgxray -- npx -y pkgxray
```

### Codex

**Platform CLI**
```bash
codex mcp add pkgxray -- npx -y pkgxray
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "pkgxray": {
            "command": "npx",
            "args": [
                "-y",
                "pkgxray"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "pkgxray": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "pkgxray"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add pkgxray npx -y pkgxray
```

## When to use it
- check an npm package before installation
- screen an MCP server before connecting
- spot malicious install-time scripts
- compare an npm archive with its GitHub source
- flag suspicious entries in a lockfile

## Example prompts
- Inspect `npm:express@4.21.0` before installation and report the verdict with its evidence.
- Scan this MCP server before I connect it and list the findings that need review.
- Audit the project lockfile and identify packages that require manual investigation.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md