
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@pkgseer/cli
Advanced tools
CLI companion for PkgSeer - package intelligence for developers and AI assistants
CLI and MCP server for PkgSeer — package intelligence for developers and AI assistants.
Query package metadata, security vulnerabilities, dependencies, and quality metrics across npm and PyPI registries.
# Run directly with npx (no install needed)
npx @pkgseer/cli
# Or install globally
npm install -g @pkgseer/cli
# Authenticate (optional, for higher rate limits)
pkgseer login
# Start MCP server for AI assistants
pkgseer mcp
pkgseer --help # Show all commands
pkgseer --version # Show version
pkgseer login # Authenticate with PkgSeer
pkgseer logout # Clear stored credentials
pkgseer auth status # Check authentication status
pkgseer mcp # Start MCP server
The MCP (Model Context Protocol) server exposes package intelligence tools to AI assistants like Claude, Cursor, and others.
| Tool | Description |
|---|---|
package_summary | Package metadata, versions, security advisories, quickstart info |
package_vulnerabilities | Security vulnerabilities affecting a package |
package_dependencies | Direct and transitive dependency tree |
package_quality | Quality metrics and scores |
compare_packages | Side-by-side comparison of multiple packages |
All tools support both npm and pypi registries.
| Environment Variable | Default | Description |
|---|---|---|
PKGSEER_API_URL | https://pkgseer.dev/api/graphql | API endpoint |
PKGSEER_API_TOKEN | — | Authentication token (from pkgseer login) |
Add to .cursor/mcp.json:
{
"mcpServers": {
"pkgseer": {
"command": "npx",
"args": ["-y", "@pkgseer/cli", "mcp"]
}
}
}
Add to Claude Desktop config:
{
"mcpServers": {
"pkgseer": {
"command": "npx",
"args": ["-y", "@pkgseer/cli", "mcp"]
}
}
}
Authentication is optional but recommended for higher rate limits.
# Opens browser for OAuth login
pkgseer login
# Credentials stored in ~/.pkgseer/
MIT © Juha Litola
FAQs
Retired - use githits instead: https://github.com/githits-com/githits-cli
The npm package @pkgseer/cli receives a total of 123 weekly downloads. As such, @pkgseer/cli popularity was classified as not popular.
We found that @pkgseer/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.