security_fetch_package_maintainer_history

Active

declared in 3.4.2

Analyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0), and maintainer_health (healthy | stale | abandoned | suspicious). Rate limit: 60/minute. No auth required. For security engineers auditing open-source dependencies before inclusion in production builds. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_maintainer_history", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Parameters schema

{
  "type": "object",
  "required": [
    "package_name",
    "ecosystem"
  ],
  "properties": {
    "ecosystem": {
      "enum": [
        "npm",
        "pypi",
        "cargo",
        "go"
      ],
      "type": "string",
      "description": "Package ecosystem: npm, pypi, cargo, go. Required."
    },
    "package_name": {
      "type": "string",
      "description": "Package name e.g. requests. Required."
    }
  },
  "additionalProperties": false
}

What this tool wraps· 0 endpoints

min confidence0.70 0.50

No endpoints wrapped at confidence ≥ 0.70.

Parent server

DataNexus MCP

1/7 registries

View full server →