Mmcp.market

Npm MCP server

by Dave-London·io.github.Dave-London/npm·v0.8.0·138 stars
No reviews yet

Structured npm/pnpm operations (install, audit, outdated, list) as typed JSON.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

138 stars

Reviews

Write one

Nobody has reviewed Npm yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Npm tools (8, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • auditwrite action

    Runs npm audit and returns structured vulnerability data. Use instead of running `npm audit` in the terminal.

  • info

    Shows detailed package metadata from the npm registry. Use instead of running `npm info` in the terminal.

  • init

    Initializes a new package.json in the target directory. Returns structured output with the package name, version, and path.

  • installwrite action

    Runs npm install and returns a structured summary of added/removed packages and vulnerabilities.

  • list

    Lists installed packages as structured dependency data. Use instead of running `npm list` in the terminal.

  • outdated

    Checks for outdated packages and returns structured update information. Use instead of running `npm outdated` in the terminal.

  • runwrite action

    Runs a package.json script via `npm run <script>` and returns structured output with exit code, stdout, stderr, and duration. Use instead of running `npm run` in the terminal.

  • search

    Searches the npm registry for packages matching a query. Use instead of running `npm search` in the terminal.

Public scan report

scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it

no findings
  • Code scan31 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 6 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Install Npm in Claude Code, Cursor or VS Code

Runs npx -y @paretools/npm on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add npm -- npx -y @paretools/npm
Add to Cursor

What the publisher says

From the Npm repository's README, as published. We do not edit it. Read it on GitHub

&nbsp;&nbsp;Pare

Reliable, structured CLI output for AI agents — no more parsing fragile terminal text.

Pare provides MCP servers that wrap common developer tools (git, npm, docker, test runners, etc.) and return clean, schema-validated JSON instead of raw terminal text. Agents get typed data they can act on directly, without brittle string parsing.

The Problem

Parsing CLI output is fragile. Raw terminal text includes ANSI escape codes, decorative headers, progress bars, locale-specific formatting, and platform differences that break agent workflows in subtle ways. An agent that works fine with git status on macOS may fail on Windows because the output format changed. A test runner's summary line might shift between versions, silently breaking a regex.

Pare eliminates this entire class of errors by returning schema-validated JSON with consistent field names, regardless of platform, tool version, or locale. As a bonus, structured output is significantly smaller — agents use fewer tokens per tool call:

Token estimates use ~4 chars/token. The biggest savings appear on verbose commands (builds, installs, tests). For simpler tools like eslint or tsc, the main advantage is reliable structured data — agents can use typed JSON directly rather than parsing strings.

How It Works

Each Pare tool returns two outputs:

  • content — human-readable text, for MCP clients that display it
  • structuredContent — typed, schema-validated JSON, ready for agents to process

This uses MCP's structuredContent and outputSchema features to provide type-safe, validated data that agents can rely on without custom parsing.

Example: git status

Raw git output (~118 tokens):

On branch main
Your branch is ahead of 'origin/main' by 2 commits.
  (use "git push" to publish your local commits)

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Npm: common questions

Is Npm MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Npm safety report
How do I install Npm?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Npm need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Npm maintained?
The last commit was 21 days ago (2026-09-22). The latest release is v0.8.0.

More from Dave-London →