NPMScan is a remote MCP server that gives an AI agent 23 tools, among them analyze_install_script, analyze_transitive_dependencies, audit_github_repository. It answers at https://npmscan.com/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 24 October 2026, succeeded.
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
analyze_install_script | Statically scans a package's preinstall/install/postinstall/prepare lifecycle scripts AND the file(s) they reference — fetched directly from the published tarball, not just the command string in package.json — against npmscan's documented r Inputs: name, version |
analyze_transitive_dependencies | Recursively resolves one or more direct/root packages' dependency graphs — e.g. the "dependencies" section of a package.json — up to maxDepth levels deep (default 2, max 3) and batch-checks every resolved package@version against OSV.dev, so Inputs: packages, maxDepth |
audit_github_repository | Given a GitHub repository URL, fetches its package.json (and, if present, a pnpm-lock.yaml/package-lock.json/yarn.lock — first one found wins, in that priority order) straight from the repo's default branch and runs the same vulnerability, Inputs: url, ref, includeDevDependencies, includePeerDependencies, policy |
batch_query_vulnerabilities | Query OSV.dev for known vulnerabilities across a whole npm dependency inventory at once: either pass a flat {packages:[...]} list, or paste raw package.json / lockfile / CycloneDX JSON / SPDX JSON content via `content`. The tool normalizes Inputs: packages, content, includeDevDependencies, includePeerDependencies |
check_license_compliance | Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compli Inputs: packages, policy |
check_maintainer_blast_radius | Given an npm username, finds every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search — the same reverse lookup npmjs.com's own site search uses; the public registry AP Inputs: maintainerUsername |
check_maintainer_changes | Reconstructs a package's maintainer-change history straight from the npm packument — every published version carries the maintainers-list SNAPSHOT as it stood at that publish plus who actually ran `npm publish` (`_npmUser`), so diffing cons Inputs: name |
check_package_provenance | Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parse Inputs: name, version |
compare_packages | Given 2-5 candidate packages for the same job (e.g. "axios vs got vs node-fetch"), fetches the same registry/popularity/maintenance/vulnerability enrichment get_package computes for each one in parallel and returns a structured side-by-side Inputs: packages |
diff_dependencies | Compares two raw snapshots of a package.json, package-lock.json (npm v1-v3), yarn.lock (classic v1 or Berry), or pnpm-lock.yaml — e.g. before/after a PR — and reports which packages were added, removed, or version-bumped. An npm alias (e.g. Inputs: before, after |
enrich_npm_audit | Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same patch-no Inputs: content |
generate_sbom | Given the same inputs batch_query_vulnerabilities accepts — either a flat {packages:[...]} list, or raw package.json / lockfile / CycloneDX JSON / SPDX JSON content via `content` — emits a spec-valid CycloneDX 1.6 or SPDX 2.3 JSON document Inputs: packages, content, format, includeDevDependencies, includePeerDependencies, includeVulnerabilities |
get_cve | Look up authoritative NIST NVD data for one exact CVE ID (e.g. "CVE-2026-2950"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date range. Every result is enriched with CISA KEV status (`kev`, non-null only if this C Inputs: cveId, keywordSearch, severity, cweId, publishedSince, publishedUntil |
get_latest_advisories | Browse recently published npm security advisories and known-malicious-package findings. Three disjoint sources, selected via type: "reviewed" (default) is GitHub's curated, mostly CVE-backed advisories; "malware" is GitHub's own known-malic Inputs: type, severity, category, affects, ghsaId, cveId |
get_maintainer_profile | Given an npm username, returns every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search — the public registry API has no dedicated 'list packages by maintainer' endpoin Inputs: maintainerUsername |
get_package | Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, recent version history, weekly downloads, GitHub stars, TypeScript support, days since last pub Inputs: name |
get_package_version | Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball) AND check that exact version against OSV.dev for known vulnerabilities — isVulnerable/highestSeverity give a direct answer, and each finding Inputs: name, version |
get_remediation_playbook | Maps a finding's `rule` value from analyze_install_script, check_maintainer_changes, or check_package_provenance to the matching human-authored incident-response playbook (the same content published at /docs/playbooks) and returns its concr Inputs: rules, id |
prioritize_remediation | Given a batch of vulnerability findings already flagged elsewhere (e.g. from batch_query_vulnerabilities, analyze_transitive_dependencies, or query_vulnerabilities across a whole package.json/lockfile audit), ranks them by what to actually Inputs: findings |
query_vulnerabilities | Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile is safe). Returns isVulnerable and highestSeverity as a direct answer, plus each Inputs: name, version, ecosystem |
search_packages | Search the npm registry by name or keywords. Each result includes its current weekly/monthly download counts, dependentsCount (how many other npm packages depend on it), topPackagesRank (position among npmscan's own top-100k-by-downloads sn Inputs: query, limit |
simulate_dependency_upgrade | Given a package and a current/target version, tells you whether that specific upgrade is a safe patch/minor bump or a likely-breaking major bump, before you actually run npm install. Natural follow-up to prioritize_remediation: pass its `pa Inputs: packageName, currentVersion, targetVersion, packages |
suggest_alternative | Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks the source package's own latest-version health (deprecation, latest-version OSV Inputs: name, reason, limit |
Every block below points at https://npmscan.com/api/mcp. Pick your client and copy.
claude mcp add --transport http npmscan https://npmscan.com/api/mcp
{
"mcpServers": {
"npmscan": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://npmscan.com/api/mcp"]
}
}
}{
"mcpServers": {
"npmscan": {
"url": "https://npmscan.com/api/mcp"
}
}
}{
"servers": {
"npmscan": {
"type": "http",
"url": "https://npmscan.com/api/mcp"
}
}
}{
"context_servers": {
"npmscan": {
"url": "https://npmscan.com/api/mcp"
}
}
}{
"mcpServers": {
"npmscan": {
"serverUrl": "https://npmscan.com/api/mcp"
}
}
}{
"mcpServers": {
"npmscan": {
"url": "https://npmscan.com/api/mcp"
}
}
}name: NPMScan
version: 0.0.1
schema: v1
mcpServers:
- name: NPMScan
type: streamable-http
url: https://npmscan.com/api/mcp{
"mcpServers": {
"npmscan": {
"httpUrl": "https://npmscan.com/api/mcp"
}
}
}{
"mcpServers": {
"npmscan": {
"type": "http",
"url": "https://npmscan.com/api/mcp"
}
}
}{
"mcpServers": {
"npmscan": {
"url": "https://npmscan.com/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fnpmscan.com%2Fapi%2Fmcp&type=streamable_http&id=npmscan&name=NPMScan
It answered our last check on 24 October 2026 in 218 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
23, as returned by the server's own tools/list on 21 September 2026: analyze_install_script, analyze_transitive_dependencies, audit_github_repository, batch_query_vulnerabilities, check_license_compliance, check_maintainer_blast_radius, check_maintainer_changes, check_package_provenance, and 15 more.
It answered our last check on 24 October 2026 in 218 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://npmscan.com/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.salemalem. Endpoint host: npmscan.com. ARD identifier: urn:air:io.github.salemalem:mcp:npmscan.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.