pkgxray: Inspect What Gets Installed, Not What Executes

Pkgxray – inspect what gets installed, not what executes

I built pkgxray to secure supply chains for npm packages, MCP servers, and AI agents by analyzing code before installation. Unlike traditional antivirus, this tool uses zero-dependency static analysis to inspect tarballs without ever running untrusted code. It provides clear SAFE, REVIEW, or BLOCK verdicts, catching credential theft, prompt injections, and trojaned updates that standard tools miss.