# NPMScan (MCP server) > NPMScan is an MCP server that adds developer tools to AI assistants such as Claude Code, Cursor and VS Code. Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups. It has 332 GitHub stars, is released under the MIT license and runs as a remote server at https://npmscan.com/api/mcp. A Claude Code plugin that gives Claude read-only npm package and vulnerability lookups, backed by npmscan.com's free, unauthenticated MCP server. ## Key facts | Fact | Value | |---|---| | Repository | https://github.com/salemalem/npmscan-mcp-plugin | | GitHub stars | 332 | | License | MIT | | Language | TypeScript | | Transport | streamable-http | | Packages | none (remote only) | | Remote URL | https://npmscan.com/api/mcp | | Needs API key | no | | Official | no | | Works with | Claude Code, Cursor, VS Code, Claude.ai, ChatGPT | | Category | Developer tools | | Latest release | none | | Last commit | Oct 26, 2026 | | MCP registry name | io.github.salemalem/npmscan | ## Install ### Claude Desktop ``` Settings > Connectors > Add custom connector URL: https://npmscan.com/api/mcp ``` Remote servers are added as a custom connector, not in claude_desktop_config.json. ### Claude Code ```sh claude mcp add --transport http npmscan "https://npmscan.com/api/mcp" ``` ### Cursor (.cursor/mcp.json) ```json { "mcpServers": { "npmscan": { "url": "https://npmscan.com/api/mcp" } } } ``` ### VS Code (.vscode/mcp.json) ```json { "servers": { "npmscan": { "type": "http", "url": "https://npmscan.com/api/mcp" } } } ``` Config formats checked against the official docs on 2026-10-07. ## Tools - `search_packages`: Search the npm registry by name or keywords. Each result includes weekly/monthly download counts, dependent-package… - `get_package`: Latest version, install scripts (preinstall/install/postinstall/prepare), maintainers, license, recent version… - `get_package_version`: Metadata for one exact version plus an OSV.dev check scoped to that version — isVulnerable/highestSeverity as a direct… - `get_maintainer_profile`: Packages an npm username currently maintains via npm's own maintainer: search index, plus precomputed… - `query_vulnerabilities`: OSV.dev lookup for known vulnerabilities affecting a package, optionally scoped to a version, with… - `batch_query_vulnerabilities`: OSV.dev lookup across a whole dependency inventory at once — pass a flat packages list, or paste raw… - `get_latest_advisories`: Recently published npm advisories from one of three sources (one per call): type: "reviewed" (default) is GitHub's… - `get_cve`: NIST NVD lookup for one exact CVE ID (authoritative CVSS score/vector, CWEs, references), or a… - `analyze_install_script`: Fetches a package's published tarball and statically scans its preinstall/install/postinstall/prepare lifecycle… - `analyze_transitive_dependencies`: Recursively resolves 1-15 direct/root packages' dependency graphs to a configurable depth (default 2, max 3) and… - `check_package_provenance`: Checks a version's npm/Sigstore publish provenance against reality: flags a non-GitHub-hosted builder or an attested… - `check_maintainer_changes`: Reconstructs a package's maintainer-add/remove history from the npm packument and flags account-takeover patterns — a… - `check_maintainer_blast_radius`: Given an npm username, finds the packages that account currently maintains and flags a tight cluster of packages… - `get_remediation_playbook`: Maps a finding's rule value from analyzeinstallscript/checkmaintainerchanges/checkpackageprovenance (or an id slug… - `check_license_compliance`: Given a package list and an optional allow/deny license policy, classifies each declared SPDX license… - `diff_dependencies`: Compares two raw snapshots of a package.json, package-lock.json, yarn.lock, or pnpm-lock.yaml — e.g. - `prioritize_remediation`: Given a batch of already-flagged vulnerability findings, ranks them by what to actually fix first, into a… - `simulate_dependency_upgrade`: Classifies a specific version jump (e.g. a suggested fixedVersion) as… - `suggest_alternative`: Suggests better-maintained replacements for a deprecated, vulnerable, abandoned, or suspicious package by combining… - `compare_packages`: Given 2-5 candidate packages for the same job (e.g. "axios vs got vs node-fetch"), fans the same… - `audit_github_repository`: Given a GitHub repo URL, fetches its package.json/lockfile from the default branch (auto-detecting monorepos via… - `generate_sbom`: Generates a spec-valid CycloneDX or SPDX SBOM from the same packages/content inputs batchqueryvulnerabilities accepts,… - `enrich_npm_audit`: Ingests raw npm audit --json output directly (npm 7+ or legacy npm 6 format) and ranks it with the same CISA KEV +… ## Similar MCP servers - [gflow-cli](https://appsgit.com/mcp-servers/gflow-cli): Drive Google Flow from an agent: Veo video and Imagen image generation. (335 stars, MIT) - [Cross Code Organizer](https://appsgit.com/mcp-servers/cross-code-organizer): Cross-Code Organizer (formerly Claude Code Organizer): cross-harness config dashboard for Claude Code, Codex CLI, MCP servers, skills, memories, agents, sessions, security scanning, context budget… (385 stars, MIT) - [Awwwards MCP](https://appsgit.com/mcp-servers/awwwards-mcp): Free, open-source MCP server that gives AI coding agents (Claude Code, Codex, Cursor, OpenCode, ZCode…) design inspiration from award-winning websites — search with real screenshots, pull design… (337 stars, MIT) - [Goldentrii MCP Server](https://appsgit.com/mcp-servers/goldentrii-mcp-server): Correction-first agent memory. Precision KPI tracks if agents heed warnings. (372 stars, MIT) - [OpenLore](https://appsgit.com/mcp-servers/openlore): Deterministic, local-first memory and guardrails for AI coding agents with no LLM in the hot path. (353 stars, MIT) - [Charles MCP](https://appsgit.com/mcp-servers/charles-mcp): Charles Proxy MCP server for AI agents with live capture, structured traffic analysis, and agent-friendly tool contracts. (330 stars, MIT) --- Canonical page: https://appsgit.com/mcp-servers/npmscan Source: appsgit (https://appsgit.com), the app store for github. Data from the GitHub API, refreshed daily. Machine access: JSON API https://appsgit.com/api/v1/apps (OpenAPI: https://appsgit.com/openapi.json), MCP server https://mcp.appsgit.com/mcp, full index https://appsgit.com/llms-full.txt.