
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@pkgseer/cli
Advanced tools
CLI companion for PkgSeer - package intelligence for developers and AI assistants
CLI and MCP server for PkgSeer — package intelligence for developers and AI assistants.
Get insights about packages across npm, PyPI, Hex, and crates.io registries: search code and documentation, check security vulnerabilities, analyze dependencies, and compare packages. Works standalone or as an MCP server for AI assistants like Claude and Cursor.
Use npx without installation:
npx @pkgseer/cli --help
Or install globally:
npm install -g @pkgseer/cli
# Interactive setup (recommended for first-time users)
pkgseer init
# Or set up manually:
pkgseer login # Authenticate with your PkgSeer account
pkgseer skill init # Install as AI assistant skill
PkgSeer works with AI assistants in two ways:
Skills teach your AI assistant to use PkgSeer CLI commands through natural language:
pkgseer skill init
This installs a skill definition for Claude Code or Codex CLI. The AI runs CLI commands and reads the output.
MCP provides structured tools that AI assistants can call programmatically:
pkgseer mcp init
This provides structured tools that AI assistants can call programmatically. Configuration varies by assistant:
Claude Code / Codex CLI: The mcp init command configures these automatically.
Cursor IDE: Add to .cursor/mcp.json:
{
"mcpServers": {
"pkgseer": {
"command": "npx",
"args": ["-y", "@pkgseer/cli", "mcp", "start"]
}
}
}
Claude Desktop: Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):
{
"mcpServers": {
"pkgseer": {
"command": "npx",
"args": ["-y", "@pkgseer/cli", "mcp", "start"]
}
}
}
Search code and documentation across packages:
# Search in specific packages
pkgseer search "authentication" -P express,passport
pkgseer search "http client" -P pypi:requests,pypi:httpx
pkgseer search "json parsing" -P hex:jason,hex:poison
# Search modes
pkgseer search "auth" -P lodash --mode code # Code only
pkgseer search "auth" -P lodash --mode docs # Docs only
# Wait options (for packages that need indexing)
pkgseer search "api" -P new-package --wait 60000 # Wait up to 60s
pkgseer search "api" -P new-package --no-wait # Return immediately
# Resume long-running searches
pkgseer search "api" -P large-package --no-poll # Disable polling, get searchRef
pkgseer search --resume <searchRef> # Check status / get results
If packages haven't been indexed yet, the search will wait up to 30 seconds by default. Use --wait <ms> to customize or --no-wait to return immediately with progress info.
For long-running searches, use --no-poll to get a searchRef and later resume with --resume <ref>.
pkgseer pkg info lodash # Package summary and metadata
pkgseer pkg vulns lodash@4.17.21 # Security vulnerabilities
pkgseer pkg quality express # Quality score (0-100)
pkgseer pkg deps express # Direct dependencies
pkgseer pkg deps express --transitive # Include transitive deps
pkgseer pkg compare axios got fetch-h2 # Compare packages
Package format: [registry:]name[@version]
lodash — npm (default registry)pypi:requests — PyPIhex:phoenix — Hexcrates:serde — crates.iolodash@4.17.21 — specific versionpkgseer docs list pypi:requests # List available doc pages
pkgseer docs get lodash/chunk # Fetch specific doc page
pkgseer docs search "routing" -P express # Search docs only
pkgseer project init # Create pkgseer.yml config
pkgseer project detect # Detect package manifests
pkgseer project upload # Upload project to PkgSeer
pkgseer login # Authenticate via browser
pkgseer logout # Sign out
pkgseer auth status # Check authentication state
pkgseer config show # Display current configuration
When running as an MCP server, these tools are available:
| Tool | Description |
|---|---|
package_summary | Package metadata, versions, quickstart examples |
package_vulnerabilities | Security advisories and CVEs |
package_dependencies | Dependency tree (direct and transitive) |
package_quality | Quality score with category breakdown |
compare_packages | Side-by-side comparison of packages |
list_package_docs | Available documentation pages |
fetch_package_doc | Full content of a documentation page |
search | Search code and docs across packages |
fetch_code_context | Fetch code from search results |
search_project_docs | Search docs for packages in current project |
Create pkgseer.yml in your project root:
project: my-project-name
# Optional: limit which tools are available
enabled_tools:
- package_summary
- package_vulnerabilities
- search_project_docs
| Variable | Description |
|---|---|
PKGSEER_API_TOKEN | API token (alternative to pkgseer login) |
PKGSEER_URL | Base URL for PkgSeer (for development/testing) |
See CLAUDE.md for development guidelines.
bun install # Install dependencies
bun run dev # Development mode
bun test # Run tests
bun run build # Build for production
bun run codegen # Regenerate GraphQL types
(c) 2025-2026 Juha Litola
FAQs
Retired - use githits instead: https://github.com/githits-com/githits-cli
The npm package @pkgseer/cli receives a total of 100 weekly downloads. As such, @pkgseer/cli popularity was classified as not popular.
We found that @pkgseer/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.