# lurq

lurq checks npm packages before an agent installs them, covering suspicious names, advisories, API changes and dependency conflicts.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: jadenryu
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/jadenryu/lurq
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/lurq

## What it does

lurq connects to a coding agent through a remote MCP server and checks npm packages before they reach `package.json`. It compares package names with the live registry, looks for security advisories, inspects shipped type definitions and tests whether dependencies can coexist.

The server can review one package, compare versions and spot peer-dependency conflicts. Its scope is the JavaScript/TypeScript npm ecosystem. Remote MCP access uses an API key.

The setup wizard starts with `npx lurqrun`; the published package is `lurqrun`, while the command-line executable is `lurq`. For Claude Code, add the server with `claude mcp add --transport http lurq https://api.lurq.run/mcp`, then restart the agent.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://api.lurq.run/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http lurq https://api.lurq.run/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add lurq --url https://api.lurq.run/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "lurq": {
            "url": "https://api.lurq.run/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "lurq": {
            "type": "http",
            "url": "https://api.lurq.run/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http lurq https://api.lurq.run/mcp
```

## When to use it
- check an npm package before adding it
- spot a typo-squatted package name
- find known security advisories
- test package and peer-dependency compatibility
- compare an upgrade with project imports

## Example prompts
- Check `zod` before adding it to this project.
- Compare compatibility for `next`, `@auth/core`, and `next-auth`.
- Review the `some-package` upgrade against imports in the codebase.

## Similar
- [prototype-pollution](https://affpapa.org/en/nevibecode/skills/prototype-pollution.md) — skill · 3600 installs
- [javascript-expert](https://affpapa.org/en/nevibecode/skills/javascript-expert.md) — skill · 335 installs
- [check-npm](https://affpapa.org/en/nevibecode/skills/check-npm.md) — skill · 2800 installs
- [electron-development](https://affpapa.org/en/nevibecode/skills/mindrally-electron-development.md) — skill · 1300 installs
- [netsuite-owasp-secure-coding](https://affpapa.org/en/nevibecode/skills/netsuite-owasp-secure-coding.md) — skill · 771 installs
- [code-review](https://affpapa.org/en/nevibecode/skills/shareai-lab-code-review.md) — skill · ★ 79292

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md