npmscan
Security analysis for npm packages, built for AI agents and developer tools.
Community: Submitted by a user or imported; check the owner before granting accessOnlineNo sign-inGlobalFreeCan modify data
What it can do
- Search Packages: Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page.
- Get Package: Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a lin
- Get Package Version: Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest releas
What data it sees
Do you need an account
No: the server works without sign-in
Security analysis for npm packages, built for AI agents and developer tools.
NPMScan helps agents inspect npm packages before installation by checking for:
- Suspicious install scripts
- Obfuscated or potentially malicious code
- Credential and environment-variable access
- Network and data-exfiltration indicators
- Known vulnerabilities
- Maintainer and ownership changes
- Risky package updates and version differences
Use this MCP server to investigate package risk, compare versions, and make safer dependency decisions directly from an MCP-compatible client.
No account or API key is required.
Website: https://npmscan.com
Server tool list (6)
Raw names from tools/list. Only developers need these.
| search_packages | Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page. |
| get_package | Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page. |
| get_package_version | Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release. |
| query_vulnerabilities | Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package. |
| batch_query_vulnerabilities | Query OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call. |
| get_latest_advisories | Browse the most recently published, reviewed GitHub Security Advisories for the npm ecosystem, optionally filtered by severity. |