security_fetch_package_maintainer_history
ActiveTool of DataNexus MCP
Analyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0), and maintainer_health (healthy | stale | abandoned | suspicious). Rate limit: 60/minute. No auth required. For security engineers auditing open-source dependencies before inclusion in production builds. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_maintainer_history", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
Parameters schema
{
"type": "object",
"required": [
"package_name",
"ecosystem"
],
"properties": {
"ecosystem": {
"enum": [
"npm",
"pypi",
"cargo",
"go"
],
"type": "string",
"description": "Package ecosystem: npm, pypi, cargo, go. Required."
},
"package_name": {
"type": "string",
"description": "Package name e.g. requests. Required."
}
},
"additionalProperties": false
}No endpoints wrapped at confidence ≥ 0.50.
Parent server
DataNexus MCP
1/7 registries