Nekzus-npm-sentinel-mcp — Claude Code MCP server: features & install
Inspects NPM packages for security flaws, dependency trees, and quality scores directly from your AI coding assistant.
claude mcp add --transport http nekzus-npm-sentinel-mcp https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcpWhat Nekzus-npm-sentinel-mcp does
This server connects AI coding assistants to NPM metadata, Google's deps.dev, and the OSV.dev vulnerability database. It retrieves transitive dependency maps, bundle sizes, download frequency, and OpenSSF Scorecard metrics. When looking up package alternatives, it filters out ecosystem plugins to present direct replacements.
Results are saved to a local cache that refreshes whenever package-lock.json, pnpm-lock.yaml, or yarn.lock changes in your workspace. You can bypass this cache with ignoreCache: true. To stop indirect prompt injections, raw external documentation and changelogs are isolated within <untrusted_external_content> XML tags.
Batch operations enforce a ceiling of 25 packages per request, while search queries cannot exceed 100 characters. Inspecting a massive manifest in a single prompt will fail because of these batch boundaries.
What it helps with
- audit NPM packages for security vulnerabilities via OSV.dev
- discover direct package alternatives without ecosystem plugin noise
- inspect transitive dependency trees using
deps.dev - review OpenSSF Scorecard ratings and bundle footprint before installing
Example prompts for the agent
- Check
lodash@~4.17for known vulnerabilities and dependency risks - Find standalone alternatives for
expresswithout plugin wrappers - Compare OpenSSF metrics and download stats between
zodandvalibot
How to install Nekzus-npm-sentinel-mcp
Platform CLI: remote server
claude mcp add --transport http nekzus-npm-sentinel-mcp https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcpPlatform CLI: remote server
codex mcp add nekzus-npm-sentinel-mcp --url https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcpConfig file
{
"mcpServers": {
"nekzus-npm-sentinel-mcp": {
"url": "https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp"
}
}
}Config file
{
"servers": {
"nekzus-npm-sentinel-mcp": {
"type": "http",
"url": "https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http nekzus-npm-sentinel-mcp https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Nekzus-npm-sentinel-mcp
How to install Nekzus-npm-sentinel-mcp in Claude Code?
Run claude mcp add --transport http nekzus-npm-sentinel-mcp https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp in your terminal.
What does Nekzus-npm-sentinel-mcp do?
It equips models with tools to inspect package health, check CVE records, map dependency trees, and evaluate open-source maintenance metrics.
How does the server stop prompt injection attacks from untrusted README files?
External markdown is wrapped in <untrusted_external_content> tags and flagged with _meta.untrustedExternalContent = true, instructing the model to treat external text strictly as passive data.
