One entry per package as "registry:name". Use "npm:" for npm and "pypi:" for PyPI. Scoped npm packages are supported (e.g. "npm:@babel/core"). Entries without a prefix default to npm.

Type:string[]

Manifest URLs (optional)

manifestUrls

Optional

Raw URLs to a package.json or requirements.txt file. Every dependency found is added to the watch list automatically.

Type:string[]

Detect typosquats

watchTyposquats

Optional

Scan each registry for newly-published packages whose name is a near look-alike of a watched package.

Type:boolean

Default:true

Typosquat edit distance

typosquatDistance

Optional

Maximum Levenshtein edit distance for a name to count as a typosquat (1-3). Lower = stricter.

Type:integer

Minimum:1

Maximum:3

Default:2

Alert on new versions

checkNewVersions

Optional

Report versions published since the previous run.

Type:boolean

Default:true

Alert on deprecations

checkDeprecations

Optional

Report versions newly marked as deprecated (npm).

Type:boolean

Default:true

Alert on license changes

checkLicenseChanges

Optional

Report when a package's license changes.

Type:boolean

Default:true

Alert on maintainer changes

checkMaintainerChanges

Optional

Report when maintainers/owners are added or removed (takeover signal).

Type:boolean

Default:true

Alert on yanked releases

checkYanked

Optional

Report versions newly yanked (PyPI).

Type:boolean

Default:true

Proxy Configuration

proxyConfiguration

Optional

Optional proxy settings. Not required — npm and PyPI registry APIs have no anti-bot.

Type:object

Zentra Actor Supply Chain Inspector

zentrafoundry/zentra-actor-supply-chain-inspector

Audit Actor codebases for supply-chain, dependency, Dockerfile, license, and secret risks.

Zentra

Open Source Supply Chain Risk MCP

ryanclinton/open-source-supply-chain-risk-mcp

OSS supply chain risk intelligence with dependency graph propagation, bus-factor analysis, and typosquat detection.

Ryan Clinton

Dependency Supply-Chain Risk Audit

scrapeworks/dependency-risk-audit

Audit your package.json or requirements.txt for supply-chain risk: known vulnerabilities (OSV), deprecated/abandoned packages, and a project-level risk score.

Nicolas van Arkens

Shipping & Supply Chain Disruption Alert

george.the.developer/shipping-disruption-tracker

Track shipping disruptions, port delays, and supply chain risks in real time. Get alerts on route changes, congestion, and weather impacts. Built for logistics and supply chain teams.

George Kioko

Food Safety Supply Chain MCP Server

ryanclinton/food-safety-supply-chain-mcp

Food safety and supply chain risk intelligence via the Model Context Protocol.

Ryan Clinton

Supply Chain Intel

fiery_dream/supply-chain-intel

AI-powered supply chain risk monitoring and intelligence. Track disruptions, tariffs, port congestion, and geopolitical events affecting global supply chains.