Package Health Check in Cursor
Vulnerabilities and upkeep. The MCP server is https://packages.openkrill.app/mcp. No key. The steps below are only for Cursor. A call to check_package was checked against that server on 2026-10-01.
What this server answers
Check an npm or Python package before you depend on it, or the dependencies of a package.json you already have, and get the facts from public sources.
Ask "is lodash 4.17.15 vulnerable?", "is this npm package maintained?", "what license is this package?", "safer alternative to request" or "check my package.json for known vulnerabilities".
Package Health Check reads OSV.dev for known vulnerabilities, the npm registry and the PyPI JSON API for deprecation notices, licenses and versions, deps.dev for release history and dependents, and npm for weekly downloads.
For one package it reports the advisories that affect the version you name (or the latest), how severe each is and the version that fixes it, the license, any deprecation notice, the last release date, how many releases came out in the last year, and how many packages depend on it.
For a package.json it looks up every dependency at the version the file names and lists the ones with known vulnerabilities, most severe first. Version ranges are checked at their lowest version, so a lockfile gives the exact answer for what is installed.
It only needs public package names and versions. Never paste source code, tokens or private package names: a package.json is read for its dependency names and versions only, is not stored, and the rest of the file is ignored.
A recent release date is not a security guarantee, and a package with no known advisories can still be vulnerable. It does not scan source code or recommend replacements on its own: when a package is deprecated or abandoned, ChatGPT suggests candidates and checks each one.
What it can do
- Lists known vulnerabilities of an npm or PyPI package version with severity and the fixed version
- Shows the license, deprecation notice, last release date and release pace of a package
- Shows how many packages depend on a package and its weekly npm downloads
- Checks every dependency of a pasted package.json for known vulnerabilities
- Checks candidate replacements for a deprecated or abandoned package
Tools
check_package, Check a package's health. Use this when the user asks whether an npm or PyPI package is vulnerable, maintained, deprecated or safe to use, or what license it has: "is lodash 4.17.15 vulnerable?", "is this npm package maintained?", "what license is this package?", "safer alternative to request". Pass the public package name, ecosystem (npm or pypi) and a version if the user gave one; otherwise the latest is checked. Returns the known vulnerabilities of that version with severity and fixed version, the license, any deprecation notice, last release date, releases in the last year, weekly downloads (npm) and dependents. It does not pick alternatives: for a deprecated or stale package, suggest candidates and check each one with this tool.check_package_json, Check package.json for vulnerabilities. Use this when the user asks to check their package.json, or the dependencies of a project, for known vulnerabilities: "check my package.json for known vulnerabilities". Pass the text of the package.json; only the names and versions in dependencies, devDependencies and optionalDependencies are read, nothing else in the file is used or kept, and nothing is stored. Do not ask for source code or tokens. Checks up to 150 npm dependencies at the version each names (ranges at their lowest version) and returns the vulnerable ones, most severe first, with the fixed version. Dependencies without an exact version (tags, urls, workspaces) are listed as skipped.
Add Package Health Check in Cursor
Cursor reads MCP servers from mcp.json. A project file at .cursor/mcp.json applies to that project. A user file at ~/.cursor/mcp.json applies everywhere. These steps were checked against the Cursor MCP docs on 2026-10-01. Streamable HTTP is the transport: a url, not a shell command.
Create or edit the file so it contains this server. Merge it with servers you already have. Do not replace the whole file if other servers are listed.
{
"mcpServers": {
"packages": {
"url": "https://packages.openkrill.app/mcp"
}
}
}No headers and no auth block. Those are for servers that require a token or a pre-registered OAuth client. Package Health Check answers without either. Saving the file is the install. Open Cursor Settings, then MCP, and confirm Package Health Check is enabled. If it stays disconnected, reload the window. You should see check_package, check_package_json.
In Agent chat, ask: Is lodash 4.17.15 vulnerable? Cursor calls the tool over streamable HTTP and shows the arguments before it runs them, depending on your run mode. Approve the call the first time and read the result. The server is public and read-only. It does not see your repository unless the model puts repository text into the arguments, so do not paste secrets into the question.
A one-click Marketplace install does not exist for this server. The JSON above is the whole setup. Team admins can distribute the same url through a team marketplace, but that is an admin step, not something this page can do for you. OAuth redirect URLs in the Cursor docs matter only for servers that require sign-in. Skip them here.
A call checked on 2026-10-01
lodash 4.17.15 is a public npm release with a known advisory, so the vulnerability fields can be checked. The request below was posted to https://packages.openkrill.app/mcp as tools/call. HTTP 200. Source: the Package Health Check server, read 2026-10-01.
{
"method": "tools/call",
"params": {
"name": "check_package",
"arguments": {
"name": "lodash",
"ecosystem": "npm",
"version": "4.17.15"
}
}
}- status. ok
- name. lodash
- vulnerabilities. 6 returned
Repeat the call yourself if you need a newer reading. Cached answers expire. A rate limit is not a result: wait and try again. Nothing in the call is a ranking, a filing, or advice.