Npm Advisor MCP server

Read from the package source without running it. The installed server may list more.

• audit_package

  Check an npm package for known security vulnerabilities using the npm advisory database. Returns CVE count, severity breakdown, affected version ranges, and patch availability.

• check_deprecation

  Check if an npm package is deprecated, unmaintained, or has an official successor. Analyzes npm deprecation flag, last publish date, maintenance scores, and download trends.

• check_registry

  Diagnostic tool — shows which registry URL and auth credentials the server resolves for a given package name based on ~/.npmrc. Useful for debugging private registry access.

• compare_packages

  Compare 2–5 npm packages side-by-side on key metrics: bundle size, downloads, TypeScript support, maintenance, dependencies, and last publish date.

• find_alternatives

  Find similar or competing npm packages as alternatives to a given package. Useful when migrating away from deprecated or unmaintained packages.

• generate_install_command

  Generate ready-to-paste install commands for a package across npm, yarn, pnpm, and bun. Automatically includes peer dependencies and TypeScript @types if needed.

• get_changelog

  Fetch the changelog or recent release notes for an npm package from its GitHub repository. Shows version history, release dates, and what changed.

• get_package_details

  Get detailed information about a specific npm package including API surface, README excerpt, dependencies, bundle size, scores, and usage examples.

• recommend_package

  Get a weighted recommendation from a list of npm packages. Scores based on bundle size (25%), popularity (20%), maintenance (20%), TypeScript support (15%), dependency count (10%), and freshness (10%). Optionally specify a max bundle size or use case to adjust weights.

• resolve_technical_doubt

  Answer a specific technical question about an npm package by analyzing its metadata, README, dependencies, and characteristics.

• search_packages

  Search npm for packages matching a feature or keyword. Returns top candidates with downloads, bundle size, and quality scores.

• Code scan41 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 56 days ago12/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

88/100

higher than 80% of 3,470 Web search servers

Tools

11

the typical Web search server has 5

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

36

more than 22% of 827 Web search servers with a package

Npm Advisor: common questions

Is Npm Advisor MCP server safe?

Yes, by our scan: it is graded A (88/100). Read the Npm Advisor safety report

How do I install Npm Advisor?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Npm Advisor need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Npm Advisor maintained?

The last commit was 97 days ago (2026-07-30). The latest release is v0.1.3.

What can I use instead of Npm Advisor?

Servers from other publishers that do the same job: Kody MCP server.

How does Npm Advisor compare with other Web search MCP servers?

safety score 88/100 (higher than 80% of 3,470 Web search servers); tools 11 (the typical Web search server has 5); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.