Server definition

Hash: sha256:c40bbf5e165b2604564270b3409d4d491f89a7cdbe5e1e9fa65a4e5f30eaf965
What it is: What a remote MCP server returned when asked what it offers: 2 tools

The blob, as servednamed by its sha256

{
  "instructions": "Before installing or running code, call check_package (one package) or scan_dependencies (a manifest or lockfile) to see whether it has known vulnerabilities or is a confirmed-malicious package. Data from OSV.dev.",
  "tools": [
    {
      "description": "Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev. Free preview tier: verdict and advisory count. The paid x402 endpoint /v1/package adds advisory ids, severity, CVSS and fixed-in versions.",
      "inputSchema": {
        "properties": {
          "ecosystem": {
            "description": "One of npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet, Pub, Hex (default npm)",
            "type": "string"
          },
          "name": {
            "description": "Package name, e.g. lodash",
            "type": "string"
          },
          "version": {
            "description": "Exact version, e.g. 4.17.15",
            "type": "string"
          }
        },
        "required": [
          "name",
          "version"
        ],
        "type": "object"
      },
      "name": "check_package",
      "outputSchema": null
    },
    {
      "description": "Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Free preview tier: verdict and counts, up to 25 packages. The paid x402 endpoint /v1/scan adds per-package advisory ids, severity, CVSS and fixed-in versions (up to 500 packages).",
      "inputSchema": {
        "properties": {
          "filename": {
            "description": "Optional file name, helps type detection",
            "type": "string"
          },
          "include_dev": {
            "description": "Include devDependencies (default true)",
            "type": "boolean"
          },
          "manifest": {
            "description": "Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock)",
            "type": "string"
          },
          "packages": {
            "description": "Alternative to manifest: [{ecosystem, name, version}], up to 500",
            "items": {
              "type": "object"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "name": "scan_dependencies",
      "outputSchema": null
    }
  ]
}

Verify it yourself

curl -s https://api.teppi.xyz/v1/evidence/sha256:c40bbf5e165b2604564270b3409d4d491f89a7cdbe5e1e9fa65a4e5f30eaf965 | sha256sum