npm Supply Chain Audit MCP server
online · 100% uptimeCheck npm packages for typosquats, hallucinated names, install scripts and risky new releases.
0 stars
Reviews
Write oneNobody has reviewed npm Supply Chain Audit yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
npm Supply Chain Audit tools
Tool list not cached yet. `describe` through the gateway fetches it live.
Public scan report
scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 428ms (auth required)20/20
- –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
- Auth qualityOAuth resource metadata advertised on 40115/15
- Maintenancelast push 0 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
How npm Supply Chain Audit compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 93/100
- higher than 96% of 48,255 servers
- Uptime
- 100%
- of our recent checks; the typical remote server answers 100%
- Response time
- 541 ms
- faster than 27% of 30,031 servers
Install npm Supply Chain Audit in Claude Code, Cursor or VS Code
claude mcp add --transport http npm-supply-chain-audit-mcp https://npm-supply-chain-audit-mcp.mcpize.run/mcp
What the publisher says
From the npm Supply Chain Audit repository's README, as published. We do not edit it. Read it on GitHub
npm-supply-chain-audit-mcp
An MCP server that audits package.json for the real mechanisms behind actual npm supply-chain incidents — typosquatting and malicious install scripts — not a generic vulnerability-database lookup.
What it catches
Typosquatting. Dependency names within 1-2 character edit distance of one of the npm registry's most-depended-on packages (lodash, express, react, axios, and ~90 others) — the actual real targets of typosquat campaigns, since attackers go after the packages with the largest install base. lodahs, expres, reqeust all flag; an unrelated, genuinely distinct package name doesn't.
Malicious install scripts. preinstall/install/postinstall hooks run automatically on npm install, before any of the package's own code is ever reviewed — the actual delivery mechanism behind real incidents (event-stream 2018, ua-parser-js 2021, and others since). Flags scripts that pipe a remote download directly into a shell, and scripts that decode an obfuscated base64 payload before running it.
Unpinned versions. Dependencies on * or latest pull in whatever gets published next, silently, with no diff in your repo to explain why your dependency tree changed.
Tools
auditpackagejson
Full audit of a package.json file.
checkpackagename
Focused typosquat check on a single package name.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
secrets-leak-audit-mcp, mcp-trust-audit-mcp, github-actions-audit-mcp, dockerfile-audit-mcp.
License
MIT
Update 1.1.0 (2026-10-01)
- New tools inspectpackagelive and auditdependencieslive: look packages up on the live npm registry. Flags names that do not exist (hallucinated or mistyped), brand-new low-traffic packages, install scripts, deprecated releases and typosquats.
Nothing above is checked by us. What we check is on the safety report.
npm Supply Chain Audit: common questions
- Is npm Supply Chain Audit MCP server safe?
- Yes, by our scan: it is graded A (93/100). Read the npm Supply Chain Audit safety report
- How do I install npm Supply Chain Audit?
- It runs remotely at npm-supply-chain-audit-mcp.mcpize.run. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does npm Supply Chain Audit need an API key?
- No key to paste: it signs you in with OAuth when your client connects.
- Is npm Supply Chain Audit maintained?
- The last commit was 33 days ago (2026-10-01). The latest release is v1.1.0.
- Is npm Supply Chain Audit up?
- 100% of our last 28 checks got an answer. We check remote servers about four times a day.
- How does npm Supply Chain Audit compare with other MCP servers?
- safety score 93/100 (higher than 96% of 48,255 servers); uptime 100% (of our recent checks; the typical remote server answers 100%); response time 541 ms (faster than 27% of 30,031 servers). Full comparison.