pkg-oracle — Dependency Trust Oracle

Dependency Trust Oracle. Call this BEFORE writing any package into a manifest (package.json, requirements.txt, pyproject.toml, ...). It checks whether the package actually exists on its registry, cross-references OSV.dev for known CVEs, pulls the package's OpenSSF Scorecard via deps.dev, and runs a Levenshtein-distance typosquat/slopsquat check against a curated list of popular packages combined with the package's publish age. Returns a synthetic verdict: ALLOW (no issues found), WARN (proceed with caution — read the findings before installing), or BLOCK (do not install — likely a hallucinated package name, an active typosquat, or a known critical/high-severity vulnerability). Always call this before running an install command for a package you have not already verified in this session. First 5 calls per caller are free; after that this tool requires x402 payment (USDC on Base) and will return a payment-required error with the amount and address to pay.

{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['ecosystem', 'name'], 'properties': {'name': {'type': 'string', 'maxLength': 214, 'minLength': 1, 'description': 'Exact package name as it would appear in the manifest (case-sensitive for npm scoped packages).'}, 'version': {'type': 'string', 'maxLength': 100, 'minLength': 1, 'description': 'Optional exact version string to verify (e.g. "4.17.21"). Omit to check only the package name.'}, 'ecosystem': {'enum': ['npm', 'pypi'], 'type': 'string', 'description': 'Package registry to check the name against.'}}, 'additionalProperties': False}