NPMScan

Settings > Connectors > Add custom connector
URL: https://npmscan.com/api/mcp

claude mcp add --transport http npmscan "https://npmscan.com/api/mcp"

{
  "mcpServers": {
    "npmscan": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

{
  "servers": {
    "npmscan": {
      "type": "http",
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

Config formats checked against the official docs on Oct 7, 2026: modelcontextprotocol.io (opens in a new tab), code.claude.com (opens in a new tab), cursor.com (opens in a new tab), code.visualstudio.com (opens in a new tab).

• search_packages

  Search the npm registry by name or keywords. Each result includes weekly/monthly download counts, dependent-package…

• get_package

  Latest version, install scripts (preinstall/install/postinstall/prepare), maintainers, license, recent version…

• get_package_version

  Metadata for one exact version plus an OSV.dev check scoped to that version — isVulnerable/highestSeverity as a direct…

• get_maintainer_profile

  Packages an npm username currently maintains via npm's own maintainer: search index, plus precomputed…

• query_vulnerabilities

  OSV.dev lookup for known vulnerabilities affecting a package, optionally scoped to a version, with…

• batch_query_vulnerabilities

  OSV.dev lookup across a whole dependency inventory at once — pass a flat packages list, or paste raw…

• get_latest_advisories

  Recently published npm advisories from one of three sources (one per call): type: "reviewed" (default) is GitHub's…

• get_cve

  NIST NVD lookup for one exact CVE ID (authoritative CVSS score/vector, CWEs, references), or a…

• analyze_install_script

  Fetches a package's published tarball and statically scans its preinstall/install/postinstall/prepare lifecycle…

• analyze_transitive_dependencies

  Recursively resolves 1-15 direct/root packages' dependency graphs to a configurable depth (default 2, max 3) and…

• check_package_provenance

  Checks a version's npm/Sigstore publish provenance against reality: flags a non-GitHub-hosted builder or an attested…

• check_maintainer_changes

  Reconstructs a package's maintainer-add/remove history from the npm packument and flags account-takeover patterns — a…

• check_maintainer_blast_radius

  Given an npm username, finds the packages that account currently maintains and flags a tight cluster of packages…

• get_remediation_playbook

  Maps a finding's rule value from analyzeinstallscript/checkmaintainerchanges/checkpackageprovenance (or an id slug…

• check_license_compliance

  Given a package list and an optional allow/deny license policy, classifies each declared SPDX license…

• diff_dependencies

  Compares two raw snapshots of a package.json, package-lock.json, yarn.lock, or pnpm-lock.yaml — e.g.

• prioritize_remediation

  Given a batch of already-flagged vulnerability findings, ranks them by what to actually fix first, into a…

• simulate_dependency_upgrade

  Classifies a specific version jump (e.g. a suggested fixedVersion) as…

• suggest_alternative

  Suggests better-maintained replacements for a deprecated, vulnerable, abandoned, or suspicious package by combining…

• compare_packages

  Given 2-5 candidate packages for the same job (e.g. "axios vs got vs node-fetch"), fans the same…

• audit_github_repository

  Given a GitHub repo URL, fetches its package.json/lockfile from the default branch (auto-detecting monorepos via…

• generate_sbom

  Generates a spec-valid CycloneDX or SPDX SBOM from the same packages/content inputs batchqueryvulnerabilities accepts,…

• enrich_npm_audit

  Ingests raw npm audit --json output directly (npm 7+ or legacy npm 6 format) and ranks it with the same CISA KEV +…

A Claude Code plugin that gives Claude read-only npm package and vulnerability lookups, backed by npmscan.com's free, unauthenticated MCP server.

• gemini-cli-extension
• mcp
• npm
• security
• supply-chain-security