Pre-Install Dependency Auditor

Scan an npm package or MCP server for malicious code before you install it

Problem

npm supply-chain poisoning and malicious MCP servers are rising, yet ordinary developers have almost no low-cost way to judge whether a package is trustworthy before installing it. Someone already built a tool to check npm packages or MCP servers for malicious code before install, showing that 'verify first' is a real developer instinct, not an after-the-fact fix.

Solution

A pre-install audit tool: enter a package name or MCP server address and get a quick summary of suspicious behavior (postinstall scripts, outbound network calls, obfuscated code, unusual permissions, recent maintainer changes) with a risk rating and explanation. Ships as a CLI, an IDE plugin, and a CI hook.

Users

Node.js and front-end developers, AI engineers using MCP servers, and small teams that care about supply-chain security

MVP

One-line npx CLI query; detect postinstall/preinstall scripts, suspicious network calls, and obfuscated code; output a risk score with explainable reasons; audit MCP server manifests; run as a CI pre-check

Revenue

Free CLI with a team subscription for private registry scanning, CI integration, and policy management; API billing for security teams

Why now

npm supply-chain attacks and the MCP ecosystem explosion are happening simultaneously, pushing demand for 'check before installing' while existing tools skew enterprise SCA and leave a gap for lightweight, individual-facing pre-checks.