MCP.Market

Npm MCP server

by alisaitteke·io.github.alisaitteke/npm-mcp·v0.0.3·3 stars
No reviews yet

MCP server for npm package management, security analysis, and compatibility checking

B75/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
New

3 stars35 downloads/wk

Reviews

Write one

Nobody has reviewed Npm yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Npm tools (12)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_bundle_size

    Analyze bundle size impact: minified, gzipped sizes, tree-shaking support, recommendations

  • analyze_capabilities

    Analyze package capabilities: ESM/CJS support, TypeScript, platforms (Node/Browser/Deno), exports, build tools

  • analyze_npx_command

    Analyze and validate an npx command before execution (security check)

  • analyze_quality

    Evaluate package quality metrics including maintenance, popularity, and sustainability

  • audit_security

    Check package for known security vulnerabilities and get recommendations

  • check_compatibility

    Analyze compatibility of a package with existing project dependencies

  • compare_packages

    Compare multiple packages side-by-side (features, size, popularity, maintenance, TypeScript support)

  • compare_versions

    Compare different versions of a package and analyze breaking changes

  • find_similar_packages

    Find similar/alternative packages based on keywords and functionality

  • generate_quick_start

    Generate ready-to-use code examples for a package (installation, basic usage, framework-specific examples)

  • get_package_details

    Get detailed information about a specific npm package including versions, dependencies, and repository info

  • search_packages

    Search npm registry for packages by name or keywords with popularity ranking

Public scan report

scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 242 days ago4/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Npm compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 40% of 915 Security servers
Tools
12
the typical Security server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 587 Security servers
Downloads a week
35
more than 23% of 248 Security servers with a package

What its tools let an agent do: 11 read · 1 create

Install Npm in Claude Code, Cursor or VS Code

Runs npx -y @alisaitteke/npm-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add npm-mcp -- npx -y @alisaitteke/npm-mcp
Add to Cursor

What the publisher says

From the Npm repository's README, as published. We do not edit it. Read it on GitHub

NPM MCP

Model Context Protocol server for npm registry

Search packages, check security, compare versions, and validate compatibility. Use it from Cursor AI or Claude Desktop.

Note: This is an unofficial, community-driven MCP server and is not affiliated with or endorsed by npm, Inc.

Features

  • Auto-Security — AI automatically checks packages before suggesting install (no user action!)
  • Capabilities Analysis — ESM/CJS, TypeScript, Platform support (Node/Browser/Deno), Build tools
  • Quick Start Generator — Ready-to-use code examples for any package
  • Package Comparison — Compare alternatives side-by-side (features, size, popularity)
  • Bundle Size Analysis — Minified/gzipped sizes, tree-shaking, impact on your bundle
  • Similar Packages — Find alternatives and similar packages
  • Search — Find packages with ranking and scores
  • Details — Versions, dependencies, download stats, deprecation status
  • Security — Vulnerability check and safe version tips
  • Compatibility — Peer dependency and version conflicts
  • Quality — Maintenance and community metrics
  • Version compare — Breaking changes and semver

Install & use

With npx (recommended)

No global install. Add to Cursor or Claude config:

Cursor — ~/.cursor/mcp.json:

{
  "mcpServers": {
    "npm-registry-mcp": {
      "command": "npx",
      "args": ["@alisaitteke/npm-mcp"]
    }
  }
}

Claude Desktop — ~/Library/Application Support/Claude/claudedesktopconfig.json (macOS):

{
  "mcpServers": {
    "npm-registry-mcp": {
      "command": "npx",
      "args": ["@alisaitteke/npm-mcp"]
    }
  }
}

Global install (optional)

npm install -g @alisaitteke/npm-mcp

Then use "command": "npm-mcp" (no args) in the config above.

What you can ask

Once the server is connected, you can ask things like:

  • “Search for React state management libraries”
  • “Security audit for express@4.18”
  • “Is lodash@4.17 compatible with my current deps?”
  • “Compare React 17 and 18”
  • “Quality check for date-fns”
  • “Is it safe to run npx create-next-app?”

License

MIT

Contributors

Ali Sait Teke Creator & Maintainer

Thanks to everyone who helps improve this project!

Nothing above is checked by us. What we check is on the safety report.

Npm: common questions

Is Npm MCP server safe?
Mostly: it is graded B (75/100). Read the Npm safety report
How do I install Npm?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Npm need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Npm maintained?
The last commit was 279 days ago (2026-01-29). The latest release is v0.0.3.
What can I use instead of Npm?
Servers from other publishers that do the same job: npm Registry MCP Server, Npm Sentinel MCP server and pkgxray MCP server.
How does Npm compare with other Security MCP servers?
safety score 75/100 (higher than 40% of 915 Security servers); tools 12 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Npm

Same job from other publishers: the closest match first, then the best rated.

  • npm Registry MCP Server
    npm registry MCP server — package intelligence, security audits, dependency analysis
    B
  • Npm Sentinel
    Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.
    A
  • pkgxray
    Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
    B
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • Wireshark
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
    A

More from alisaitteke →