# Nekzus-npm-sentinel-mcp

Inspects NPM packages for security flaws, dependency trees, and quality scores directly from your AI coding assistant.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 19
- Author: Nekzus
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Nekzus/npm-sentinel-mcp
- Updated: 2026-08-24
- HTML: https://affpapa.org/en/nevibecode/mcp/nekzus-npm-sentinel-mcp

## What it does

This server connects AI coding assistants to NPM metadata, Google's `deps.dev`, and the OSV.dev vulnerability database. It retrieves transitive dependency maps, bundle sizes, download frequency, and OpenSSF Scorecard metrics. When looking up package alternatives, it filters out ecosystem plugins to present direct replacements.

Results are saved to a local cache that refreshes whenever `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock` changes in your workspace. You can bypass this cache with `ignoreCache: true`. To stop indirect prompt injections, raw external documentation and changelogs are isolated within `<untrusted_external_content>` XML tags.

Batch operations enforce a ceiling of 25 packages per request, while search queries cannot exceed 100 characters. Inspecting a massive manifest in a single prompt will fail because of these batch boundaries.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http nekzus-npm-sentinel-mcp https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add nekzus-npm-sentinel-mcp --url https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "nekzus-npm-sentinel-mcp": {
            "url": "https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "nekzus-npm-sentinel-mcp": {
            "type": "http",
            "url": "https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http nekzus-npm-sentinel-mcp https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp
```

## When to use it
- audit NPM packages for security vulnerabilities via OSV.dev
- discover direct package alternatives without ecosystem plugin noise
- inspect transitive dependency trees using `deps.dev`
- review OpenSSF Scorecard ratings and bundle footprint before installing

## Example prompts
- Check `lodash@~4.17` for known vulnerabilities and dependency risks
- Find standalone alternatives for `express` without plugin wrappers
- Compare OpenSSF metrics and download stats between `zod` and `valibot`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md