npmscan
Security analysis for npm packages, built for AI agents and developer tools.
От сообщества: Добавлен пользователем или импортирован; проверьте владельца перед подключениемРаботаетБез входаГлобальныйБесплатноМожет изменять данные
Что умеет
- Search Packages: Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page.
- Get Package: Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a lin
- Get Package Version: Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest releas
Какие данные видит
Нужен ли аккаунт
Не нужен: сервер работает без входа
Security analysis for npm packages, built for AI agents and developer tools.
NPMScan helps agents inspect npm packages before installation by checking for:
- Suspicious install scripts
- Obfuscated or potentially malicious code
- Credential and environment-variable access
- Network and data-exfiltration indicators
- Known vulnerabilities
- Maintainer and ownership changes
- Risky package updates and version differences
Use this MCP server to investigate package risk, compare versions, and make safer dependency decisions directly from an MCP-compatible client.
No account or API key is required.
Website: https://npmscan.com
Список инструментов сервера (6)
Технические названия из tools/list. Нужны только разработчикам.
| search_packages | Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page. |
| get_package | Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page. |
| get_package_version | Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release. |
| query_vulnerabilities | Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package. |
| batch_query_vulnerabilities | Query OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call. |
| get_latest_advisories | Browse the most recently published, reviewed GitHub Security Advisories for the npm ecosystem, optionally filtered by severity. |