io.github.salemalem/npmscan

up checked 2026-11-11T02:37:32.165Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

NPMScan

Publisher-provided description

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Summary by lookupd

Scans npm packages and dependency trees for malicious install scripts, known vulnerabilities, maintainer changes, and licensing issues.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http npmscan https://npmscan.com/api/mcp

Codex, remote (streamable-http)

codex mcp add npmscan --url https://npmscan.com/api/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "npmscan": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (23 tools)

Publisher-provided text

• search_packages Search the npm registry by name or keywords. Each result includes its current weekly/monthly download counts, dependentsCount (how many other npm packages depen
• get_package Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, recent version
• get_package_version Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball) AND check that exact version against OSV.dev for known vulne
• get_maintainer_profile Given an npm username, returns every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search
• query_vulnerabilities Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile i
• batch_query_vulnerabilities Check a whole npm dependency inventory against OSV.dev in one call: pass `packages: [{name, version?}]`, or raw package.json / package-lock / yarn.lock / pnpm-l
• get_latest_advisories Browse recently published npm security advisories and known-malicious-package findings. Three disjoint sources, selected via type: "reviewed" (default) is GitHu
• get_cve Look up authoritative NIST NVD data for one exact CVE ID (e.g. "CVE-2026-2950"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date rang
• analyze_install_script Statically scans a package's preinstall/install/postinstall/prepare lifecycle scripts AND the file(s) they reference — fetched directly from the published tarba
• analyze_transitive_dependencies Walk one or more root packages' dependency trees (e.g. a package.json "dependencies" section) up to `maxDepth` levels (default 2, max 3) and check every resolve
• check_package_provenance Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance
• check_maintainer_changes Reconstruct who has controlled an npm package and when, straight from the packument (each version records the maintainer list at publish time and who ran `npm p
• check_maintainer_blast_radius Given an npm username, lists the packages npm's maintainer:<username> search index returns for that account and looks for a tight cluster of packages whose late
• check_license_compliance Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny li
• diff_dependencies Compare two snapshots of a package.json, package-lock.json (v1-v3), yarn.lock (classic or Berry) or pnpm-lock.yaml (e.g. before/after a PR; formats can differ)
• prioritize_remediation Rank vulnerability findings other tools already returned (batch_query_vulnerabilities, query_vulnerabilities, analyze_transitive_dependencies, diff_dependencies
• simulate_dependency_upgrade Before running npm install, check whether upgrading a package from a current to a target version is safe. Pass `packageName` + `currentVersion` + `targetVersion
• suggest_alternative Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks
• compare_packages Compare 2-5 candidate packages for the same job (e.g. "axios vs got vs node-fetch") side by side and get a deterministic pick. More than 5 names is rejected, ne
• audit_github_repository Audit a GitHub repository's npm dependencies from its URL — no pasted files needed. Fetches package.json plus the first lockfile found (pnpm-lock.yaml, then pac
• get_remediation_playbook Maps a finding's `rule` value from analyze_install_script, check_maintainer_changes, or check_package_provenance to the matching human-authored incident-respons
• generate_sbom Given the same inputs batch_query_vulnerabilities accepts — either a flat {packages:[...]} list, or raw package.json / lockfile / CycloneDX JSON / SPDX JSON con
• enrich_npm_audit Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need t

Details

• Version: 3.1.2
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 582 ms
• First indexed: 2026-11-01T09:53:34.824Z
• Last seen in registry: 2026-11-01T09:53:34.878Z
• Repository: https://github.com/salemalem/npmscan-mcp-plugin
• Website: https://npmscan.com

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.salemalem/npmscan.svg)](https://lookupd.com/servers/io.github.salemalem/npmscan)

• 62092 servers
• Last crawl: 2026-11-11T17:17:22.074Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp