NPMScan — Claude Code MCP server: npm package checks
Wires npm registry search and vulnerability lookups through OSV.dev and GitHub into your agent. Useful when you need to know if a package is safe to install.
claude mcp add --transport http npmscan https://npmscan.com/api/mcpWhat NPMScan does
NPMScan is a public MCP server at https://npmscan.com/api/mcp exposing twenty-three tools. Your agent can search the npm registry, pull metadata for one exact version, inspect maintainer history and install scripts, and read vulnerability findings. Every result carries an npmscanUrl pointing back to the full write-up on the site.
No API key, no auth. The server keeps no state between calls, and requests are capped at thirty per minute per IP — a monorepo-wide audit will hit that ceiling fast. Each finding includes an isMalware flag, so a confirmed-malicious package arrives as malware to remove rather than an ordinary bug.
Five skills ship with it. /npmscan:dependency-audit chains the tools over a package.json, lockfile or SBOM; /npmscan:package-trust-check digs into a single package; /npmscan:new-dependency-evaluation compares candidates you are considering adding; /npmscan:incident-response assembles remediation steps; /npmscan:ci-pr-gate returns a PASS/WARN/FAIL verdict for CI.
What it helps with
- check whether a transitive dependency is malicious
- find vulnerabilities in a version pinned in the lockfile
- compare two to five candidates before adding one
- turn raw
npm audit --jsonoutput into a readable report - get a verdict on a dependency diff for a PR
Example prompts for the agent
- Audit the dependencies in
package.jsonand flag anything dangerous - Is
event-streamsafe to use? - Compare
axios,gotandnode-fetchfor this project
How to install NPMScan
Platform CLI: remote server
claude mcp add --transport http npmscan https://npmscan.com/api/mcpPlatform CLI: remote server
codex mcp add npmscan --url https://npmscan.com/api/mcpConfig file
{
"mcpServers": {
"npmscan": {
"url": "https://npmscan.com/api/mcp"
}
}
}Config file
{
"servers": {
"npmscan": {
"type": "http",
"url": "https://npmscan.com/api/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http npmscan https://npmscan.com/api/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about NPMScan
How do I install NPMScan in Claude Code?
Run claude mcp add --transport http npmscan https://npmscan.com/api/mcp.
What does NPMScan do?
It gives your agent npm registry search plus vulnerability lookups via OSV.dev and GitHub. Five skills cover dependency audits, single-package trust checks, candidate comparison, incident response and a CI gate.
Does it need an API key?
No, the server is public and unauthenticated. The limit is thirty requests per minute per IP.
