pkgxray — pre-install security for npm packages, MCP servers, and AI agents
Summary
Pkgxray provides static analysis to inspect npm packages and MCP servers before installation or connection, reporting SAFE, REVIEW, or BLOCK evidence without executing code. It combines OSV pre-checks, provenance attestation, and prompt-injection detection to assess risk and trust; designed to complement npm audit and OSV in a zero-dependency, local, pre-install gate for developer workflows. It supports CLI, MCP, runtime proxy, and CI integration, with documented threat model and calibration benchmarks.