MCP.Market

npx-vibe MCP server

by Devrajsinh-Jhala·io.github.Devrajsinh-Jhala/npx-vibe·v3.0.0
No reviews yet

Read-only npm package and project dependency preflight tools for AI applications.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars62 downloads/wk

Reviews

Write one

Nobody has reviewed npx-vibe yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

npx-vibe tools (4)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • approve_scripts

    Review every dependency npm would allow to run an install script, and return approve, review, or deny for each with the source evidence behind it. Reads package-lock.json and never executes a script. Use when npm reports pending allowScripts entries or after a lockfile change adds one.

  • list_providers

    Return the AI providers npx-vibe can call, the environment variable each reads its key from, and where that provider publishes its current model list. No model catalog is bundled, so a model must be named explicitly. This does not access a provider or require credentials.

  • scan_package

    Resolve, verify, and inspect one public npm registry package without executing package code. Use before installing, recommending, or running an unfamiliar package. Obey decision.action: continue, review, stop, or retry.

  • scan_project

    Inspect registry dependencies without installing or executing them. Default tree reviews require an npm lockfile packages map; directOnly explicitly narrows scope. Skipped packages or limits make coverage incomplete: retry, never continue. Use after dependency or lockfile changes and before installation.

Public scan report

scanner v0.1.10 · 2026-10-29 · same rubric, same numbers if you re-run it

no findings
  • Code scan22 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 27 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How npx-vibe compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 93% of 48,243 servers
Tools
4
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
62
more than 49% of 12,306 servers with a package

What its tools let an agent do: 3 read · 1 change

Release history: 2 versions in the registry since 2026-08-31, latest 2026-10-02, typically one every 32 days.

Install npx-vibe in Claude Code, Cursor or VS Code

Runs npx -y npx-vibe on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add npx-vibe -- npx -y npx-vibe
Add to Cursor

What the publisher says

From the npx-vibe repository's README, as published. We do not edit it. Read it on GitHub

npx-vibe

Evidence-first safety checks for npm packages and project dependencies before developers, coding agents, or MCP clients execute them.

npx-vibe resolves packages from the public npm registry, downloads and verifies their tarballs without executing them, inspects install-time code, and prints clear Proceed, Caution, or Block verdicts. Use it for one-off npx commands or scan an existing project's direct dependencies.

The default scan is deterministic, local, and requires no account or API key. AI review is optional, opt-in, and lets you choose an exact model or a maintained fast, balanced, or strong profile. Version 1.5 also ships a zero-dependency MCP server with read-only package, project, and model-catalog tools.

  • npm package
  • Official MCP Registry entry
  • Live website
  • GitHub repository
  • Security policy
  • Changelog
  • Release process

Live adoption

The project website displays the current seven-day download total directly from npm's public download API:

  • weekly total
  • daily seven-day range

The counter is live rather than hard-coded, and the site links to the source data. npm download counts measure package fetches, not unique users. They are momentum signals—not proof of package safety or quality—but they show that the package is being discovered and installed.

Quick start

Review a package without executing it:

npx npx-vibe esbuild

Use it as a guarded replacement for npx:

npx npx-vibe cowsay -- hello from npx-vibe

Or install the command globally:

npm install -g npx-vibe
npx-vibe <package>

Scan an existing project's direct dependencies:

npx npx-vibe --project .

Give a coding agent a stable, read-only result:

npx --yes npx-vibe@latest --agent esbuild
npx --yes npx-vibe@latest --agent --project .

Or connect the native MCP server:

npx --yes npx-vibe@latest --mcp

Use npx-vibe with coding agents

--agent turns the scanner into a predictable machine interface. It implies check-only mode, writes only JSON to stdout, disables terminal color and local review-memory writes, and never executes package code. Operational failures are JSON too, so an agent can fail closed instead of interpreting partial terminal output.

Install the portable Agent Skill for Codex, Claude Code, Cursor, VS Code, and other compatible agents:

npx skills add Devrajsinh-Jhala/NPM-Vibe-check --skill npx-vibe -g

The skill tells an agent to preflight unfamiliar packages before npx, npm exec, or dependency installation and then apply the normalized decision:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

npx-vibe: common questions

Is npx-vibe MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the npx-vibe safety report
How do I install npx-vibe?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does npx-vibe need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is npx-vibe maintained?
The last commit was 34 days ago (2026-10-02). The latest release is v3.0.0.
How does npx-vibe compare with other MCP servers?
safety score 92/100 (higher than 93% of 48,243 servers); tools 4 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.