# NPMScan

Wires npm registry search and vulnerability lookups through OSV.dev and GitHub into your agent. Useful when you need to know if a package is safe to install.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 171
- Author: salemalem
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/salemalem/npmscan-mcp-plugin
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/npmscan

## What it does

NPMScan is a public MCP server at `https://npmscan.com/api/mcp` exposing twenty-three tools. Your agent can search the npm registry, pull metadata for one exact version, inspect maintainer history and install scripts, and read vulnerability findings. Every result carries an `npmscanUrl` pointing back to the full write-up on the site.

No API key, no auth. The server keeps no state between calls, and requests are capped at thirty per minute per IP — a monorepo-wide audit will hit that ceiling fast. Each finding includes an `isMalware` flag, so a confirmed-malicious package arrives as malware to remove rather than an ordinary bug.

Five skills ship with it. `/npmscan:dependency-audit` chains the tools over a `package.json`, lockfile or SBOM; `/npmscan:package-trust-check` digs into a single package; `/npmscan:new-dependency-evaluation` compares candidates you are considering adding; `/npmscan:incident-response` assembles remediation steps; `/npmscan:ci-pr-gate` returns a PASS/WARN/FAIL verdict for CI.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://npmscan.com/api/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http npmscan https://npmscan.com/api/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add npmscan --url https://npmscan.com/api/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "npmscan": {
            "url": "https://npmscan.com/api/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "npmscan": {
            "type": "http",
            "url": "https://npmscan.com/api/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http npmscan https://npmscan.com/api/mcp
```

## When to use it
- check whether a transitive dependency is malicious
- find vulnerabilities in a version pinned in the lockfile
- compare two to five candidates before adding one
- turn raw `npm audit --json` output into a readable report
- get a verdict on a dependency diff for a PR

## Example prompts
- Audit the dependencies in `package.json` and flag anything dangerous
- Is `event-stream` safe to use?
- Compare `axios`, `got` and `node-fetch` for this project

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md