Hallucinated imports waste your afternoon; hallucinated package names can install someone else's code. Screening new packages for registry existence and near-miss similarity to popular names, before anything is installed, is a different class of protection from version-aware method checking — and you get both from the same server. Packages already in your fingerprint are skipped, since you already made that call.
A TypeScript MCP server that reads your project's installed packages and their exact versions, feeds that fingerprint into the model's context, and validates suggestions against it before you paste them into an editor.
- `get_project_context` — scans the project root and returns a fingerprint of every installed package with its exact version, cached for a few minutes so repeat calls are instant
- `validate_suggestion` — checks generated code in three layers: is every imported package in your dependencies (MISSING_PACKAGE), does every method call exist in your installed version (HALLUCINATED_METHOD), and what is the closest real alternative
- `check_package_safety` — screens new packages the model wants to install for PHANTOM_PACKAGE, LIKELY_TYPOSQUAT and LOW_TRUST_PACKAGE, using registry existence, edit distance to popular names, and age and repository signals
- `get_package_docs` — pulls live npm or PyPI metadata for a specific version so the model can correct itself
- Node and Python projects both covered, from package.json and requirements.txt
- Output written for a human: the offending identifier, the severity, and the install command or method that fixes it
Node.js 18+ and TypeScript 5+ to build; Python 3 as well if you want Python projects validated. Clone, `npm install`, `npm run build`, then point your client at build/index.js — it speaks stdio. Clients that support auto-approval can pre-approve the four tools so validation runs without a prompt each time. On Windows with fnm or nvm, use the full path to node.exe in the config, since the client may launch outside your shell session.