Grounded Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Grounded Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.nghizas/grounded -->
MCP server for real-time package versions, download counts, and service status — powered by Grounded.
Tracks 1,000+ npm and PyPI packages and 76 cloud services. No signup required.
claude mcp add grounded -- uvx grounded-mcpAdd to your claude_desktop_config.json:
{
"mcpServers": {
"grounded": {
"command": "uvx",
"args": ["grounded-mcp"]
}
}
}Add to your MCP settings:
{
"grounded": {
"command": "uvx",
"args": ["grounded-mcp"]
}
}| Tool | Description | Example |
|---|---|---|
check_package_version | Latest version of an npm or PyPI package | check_package_version("react") |
check_downloads | Weekly download count | check_downloads("flask", registry="pypi") |
check_service_status | Cloud service operational status | check_service_status("github") |
lookup_fact | General-purpose fact lookup | lookup_fact("npm", "react", "license") |
For npm/PyPI packages: latest_version, license, deprecated, dep_count, required_runtime, weekly_downloads
For services: status
Works out of the box with no API key (50 lookups/day per IP).
For higher limits, set GROUNDED_API_KEY:
claude mcp add grounded -e GROUNDED_API_KEY=your_key -- uvx grounded-mcpSign up for a free API key (1,000 req/day) at https://grounded-api.dev.
Ask your AI assistant:
"What's the latest version of React?"
The assistant calls check_package_version("react") and gets:
Value: 19.2.4
Source: https://registry.npmjs.org/react
Fetched at: 2026-03-06T12:00:00Z
Hash: sha256:a1b2c3...
Tier: warm (TTL: 300s)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.