Local MCP capabilities provider for Expo
Nothing to run from here
NPMScan is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
23
tools declared
—
trust score
remote
at its publisher
—
calls last 7d
What it does
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http npmscan-mcp https://npmscan.com/api/mcp
# 2 — ask your agent for something these tools do
# search_packages, get_package, get_package_version and 20 more
NPMScan costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
SAAll 1 server
salemalem1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http npmscan-mcp https://npmscan.com/api/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
23 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Search the npm registry by name or keywords. Each result includes its current weekly/monthly download counts, dependentsCount (how many other npm packages depend on it), topPackagesRank (position among npmscan's own top-100k-by-downloads snapshot — not live, but a second independent popularity signal), and deterministic (not model-generated) popularityTier/maintenanceTier labels — a package matchi
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | yes | Search text, e.g. a package name or keywords |
| limit | integer | no | Max results to return (default 20, max 50) |
Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, recent version history, weekly downloads, GitHub stars, TypeScript support, days since last publish, a topPackagesRank (position among npm's ~100k most-downloaded packages, from npmscan's own periodically-refreshed snapshot — not live), and a downloadTren
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact npm package name, e.g. "lodash" or "@scope/name" |
Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball) AND check that exact version against OSV.dev for known vulnerabilities — isVulnerable/highestSeverity give a direct answer, and each finding includes severity, a summary, and the fixedVersion to upgrade to. Use this to check a version pinned in a lockfile rather than the latest release. If the OSV.d
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact npm package name |
| version | string | yes | Exact version string, e.g. "4.17.21", or a dist-tag such as "latest" (resolved to its exact version before the vulnerability check). Semver ranges like "^4.17.0" are not supported. |
Given an npm username, returns every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search — the public registry API has no dedicated 'list packages by maintainer' endpoint otherwise), plus precomputed aggregates: currentlyMaintainsCount (still listed as maintainer right now vs. already-revoked), totalWeeklyDownloads and totalDep
| Parameter | Type | Required | Notes |
|---|---|---|---|
| maintainerUsername | string | yes | Exact npm username, e.g. "sindresorhus" — as shown at npmjs.com/~username. Not an email address, not a package name or scope. |
| limit | integer | no | How many packages to list (default 50, max 250), most-downloaded first. Totals still cover every package found. |
Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile is safe). Returns isVulnerable and highestSeverity as a direct answer, plus each finding's severity, a plain-language summary, CVE aliases, and the fixedVersion to upgrade to — not a raw advisory dump. Also cross-checks the name/version agai
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | npm package name (required; packageName is accepted as an alias) |
| packageName | string | no | Alias for name, matching simulate_dependency_upgrade/prioritize_remediation |
| version | string | no | Optional exact version to narrow results, e.g. to check one version pinned in a lockfile. For the npm ecosystem a dist-tag such as "latest" is also accepted and resolved to its exact version first; se |
| ecosystem | string | no | OSV ecosystem, default "npm" |
Check a whole npm dependency inventory against OSV.dev in one call: pass packages: [{name, version?}], or raw package.json / package-lock / yarn.lock / pnpm-lock / CycloneDX / SPDX content via content. Large inventories are chunked automatically. Each finding has severity, summary, CVE aliases, fixedVersion and isMalware, so no per-package follow-up is needed. Before calling anything clean, r
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | array | no | Explicit package list (1-1000 items). Use this OR content, not both. |
| content | string | no | Raw dependency inventory content: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, CycloneDX JSON, or SPDX JSON. Use this OR packages, not both. |
| includeDevDependencies | boolean | no | Ignored when using packages; only applies when content is a manifest/lockfile format that distinguishes dev dependencies. |
| includePeerDependencies | boolean | no | Ignored when using packages; only applies when content is a package.json. peerDependencies are excluded from scanning by default (see ignoredPeerDependencyNames) since a peer is often intentionall |
Browse recently published npm security advisories and known-malicious-package findings. Three disjoint sources, selected via type: "reviewed" (default) is GitHub's curated, mostly CVE-backed advisories; "malware" is GitHub's own known-malicious-package advisories; "osv" is OSV.dev's OpenSSF malicious-packages feed, a separate dataset whose entries use MAL-/OSV ids rather than GHSA ids. None of "ma
| Parameter | Type | Required | Notes |
|---|---|---|---|
| type | string | no | Advisory source: "reviewed" (curated CVE-style, default), "malware" (GitHub-curated known-malicious packages), or "osv" (OSV.dev/OpenSSF malicious-packages feed) |
| severity | string | no | Filter by severity (default all; not applicable to "malware"/"osv") |
| category | string | no | Filter by vulnerability category (reviewed only). One of: access-control, dos, xss, ssrf, auth, code-injection, info-exposure, path-traversal, input-validation, prototype-pollution, command-injection, |
| affects | string | no | Filter to advisories affecting this npm package name |
| ghsaId | string | no | Look up one exact advisory by its GHSA ID (e.g. "GHSA-xxxx-xxxx-xxxx") — reviewed/malware only |
| cveId | string | no | Look up one exact advisory by its CVE ID (e.g. "CVE-2024-12345") — reviewed/malware only |
| direction | string | no | Sort by published date, newest or oldest first (default desc) |
| cursor | string | no | Opaque pagination cursor from a previous response's nextCursor, to fetch the next page |
Look up authoritative NIST NVD data for one exact CVE ID (e.g. "CVE-2026-2950"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date range. Every result is enriched with CISA KEV status (kev, non-null only if this CVE is a confirmed, actively-exploited-in-the-wild vulnerability — treat that as an urgent-patch signal regardless of CVSS score) and FIRST.org EPSS (epss, the
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cveId | string | no | Exact CVE ID for a single lookup, e.g. "CVE-2026-2950". When given, search filters below are ignored and should be omitted. |
| keywordSearch | string | no | Free-text search, e.g. a package or product name |
| severity | string | no | Filter by CVSS v3 base severity |
| cweId | string | no | Filter by weakness type, e.g. "CWE-79" |
| publishedSince | string | no | Publication date range start (YYYY-MM-DD). Must be given together with publishedUntil. |
| publishedUntil | no | Publication date range end (YYYY-MM-DD). Must be given together with publishedSince; range is capped at 120 days. | |
| resultsPerPage | integer | no | Max results for a search (default 10, capped at 50) |
| startIndex | integer | no | Pagination offset for a search |
Statically scans a package's preinstall/install/postinstall/prepare lifecycle scripts AND the file(s) they reference — fetched directly from the published tarball, not just the command string in package.json — against npmscan's documented red-flags rubric (/docs/red-flags): child_process use, network calls, access to sensitive paths/env (.ssh, .aws, .npmrc, *TOKEN/*KEY), obfuscation, remote binari
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact npm package name, e.g. "lodash" or "@scope/name" |
| version | string | no | Exact version to analyze; omit to use the latest published version |
Walk one or more root packages' dependency trees (e.g. a package.json "dependencies" section) up to maxDepth levels (default 2, max 3) and check every resolved package@version against OSV.dev, so vulnerabilities several levels down still surface. Read summary first; vulnerablePaths answers "which of my dependencies pulled this in"; nodes has the full graph. npm aliases are followed (`actua
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | array | yes | 1-15 direct/root packages to expand from, e.g. a package.json's "dependencies". version accepts an exact version or a semver range like "^4.17.21"; omitted = latest. |
| maxDepth | integer | no | How many levels of transitive dependencies to expand beyond the given root packages (0 = only check the roots themselves). Default 2, capped at 3 to bound registry calls and stay within the request ti |
Checks whether a package version was published with npm's own Sigstore-backed publish provenance (npm publish --provenance), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attest
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact npm package name, e.g. "lodash" or "@scope/name" |
| version | string | no | Exact version to check; omit to use the latest published version |
Reconstruct who has controlled an npm package and when, straight from the packument (each version records the maintainer list at publish time and who ran npm publish). Use it for the 'who controls this package, and did that change recently' question; use get_package/check_package_provenance for general health and publish integrity. Flags: 1. a maintainer added recently who then published soon a
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact npm package name, e.g. "lodash" or "@scope/name" |
Given an npm username, lists the packages npm's maintainer:<username> search index returns for that account and looks for a tight cluster of packages whose latest version was published within a short rolling window of each other — the shape of a compromised-account supply-chain attack, where a stolen credential is used on every package the account can publish to within hours (e.g. the September 20
| Parameter | Type | Required | Notes |
|---|---|---|---|
| maintainerUsername | string | yes | Exact npm username, e.g. "sindresorhus" — as shown at npmjs.com/~username. Not an email address, not a package name or scope. |
| limit | integer | no | How many packages to list (default 50, max 250), most-downloaded first. Totals still cover every package found. |
Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and underst
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | array | yes | 1-100 packages to check. version accepts an exact version or a semver range like "^4.17.21"; omitted = latest. |
| policy | object | no | Omit entirely to use the default policy: only copyleft/network-copyleft/proprietary are violations. |
Compare two snapshots of a package.json, package-lock.json (v1-v3), yarn.lock (classic or Berry) or pnpm-lock.yaml (e.g. before/after a PR; formats can differ) and report added, removed and changed packages. Lockfiles cover the full resolved graph, so transitive-only changes are caught; npm aliases are followed (actualName). Up to 100 added/changed packages are checked in detail. Ideal for a CI
| Parameter | Type | Required | Notes |
|---|---|---|---|
| before | string | yes | Raw file content of the "before" snapshot — a package.json, package-lock.json (npm v1-v3), yarn.lock (classic v1 or Berry), or pnpm-lock.yaml. Format is auto-detected; before/after may be different fo |
| after | string | yes | Raw file content of the "after" snapshot — a package.json, package-lock.json (npm v1-v3), yarn.lock (classic v1 or Berry), or pnpm-lock.yaml. Format is auto-detected; before/after may be different for |
Rank vulnerability findings other tools already returned (batch_query_vulnerabilities, query_vulnerabilities, analyze_transitive_dependencies, diff_dependencies...) by what to fix first. Pass up to 200 {packageName, cveId?, severity?, advisoryId?, currentVersion?, fixedVersion?, findingType?}. Each gets a tier: remove-now / patch-now / patch-soon / scheduled / monitor. How the tier is decided:
| Parameter | Type | Required | Notes |
|---|---|---|---|
| findings | array | yes | 1-200 previously-flagged vulnerability findings to rank |
Before running npm install, check whether upgrading a package from a current to a target version is safe. Pass packageName + currentVersion + targetVersion (omit target for "latest"), or packages: [...] (1-100) to check many in one call; a name that cannot be resolved comes back with fetchError instead of failing the batch. A natural follow-up to prioritize_remediation: pass its packageN
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packageName | string | no | Exact npm package name, e.g. "lodash" or "@scope/name". Use this (with currentVersion) OR packages, not both. |
| name | string | no | Alias for packageName, matching the other tools |
| currentVersion | string | no | Currently installed version — an exact version (e.g. "4.17.20"), a semver range (e.g. "^4.17.0"), or a dist-tag. Required when packageName is used. |
| targetVersion | string | no | Version to simulate upgrading to — exact version, range, or dist-tag (e.g. the fixedVersion a prioritize_remediation finding named). Omit to use the registry's "latest" dist-tag. Only applies to the s |
| packages | array | no | Batch of upgrades to simulate (1-100 items), each mirroring the single-item packageName/currentVersion/targetVersion fields. Use this OR packageName/currentVersion, not both. Natural pairing with prio |
Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks the source package's own latest-version health (deprecation, latest-version OSV verdict, popularity/maintenance tiers, typosquat flag), then combines maintainer-provided deprecation hints with deterministic npm search-based category matchi
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Exact npm package name, e.g. "request" or "node-sass" |
| reason | string | no | Optional reason to bias filtering/ranking |
| limit | integer | no | Max suggestions to return (default 5, max 10) |
Compare 2-5 candidate packages for the same job (e.g. "axios vs got vs node-fetch") side by side and get a deterministic pick. More than 5 names is rejected, never truncated; duplicate names are rejected. Use search_packages first if you have no shortlist. Per candidate: downloads and trend, popularity/maintenance tiers, GitHub stars, TypeScript support, license, deprecation, latest-version vulne
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | array | yes | 2-5 exact npm package names to compare, e.g. ["axios", "got", "node-fetch"]. More than 5 is rejected with an error, not truncated. |
Audit a GitHub repository's npm dependencies from its URL — no pasted files needed. Fetches package.json plus the first lockfile found (pnpm-lock.yaml, then package-lock.json, then yarn.lock) from the default branch (or ref), and detects monorepos (package.json workspaces, pnpm-workspace.yaml), merging member dependencies (up to 50 members). What it checks: - Every lockfile entry (up to 3,000;
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | GitHub repository URL, e.g. "https://github.com/owner/repo". |
| ref | string | no | Branch, tag, or commit SHA to audit. Omit to use the repository's default branch. |
| includeDevDependencies | boolean | no | Include package.json devDependencies in the audit. Default false. Ignored when a lockfile is used instead (its own format decides direct-dependency scope), and yarn.lock can never distinguish dev from |
| includePeerDependencies | boolean | no | Include package.json peerDependencies (root and, for a monorepo, each workspace member) in the audit. Default false — a peer is often intentionally left unresolved by the consumer. See warnings for wh |
| policy | object | no | License allow/deny policy, same shape as check_license_compliance. Omit for the default policy (only copyleft/network-copyleft/proprietary are violations). |
Maps a finding's rule value from analyze_install_script, check_maintainer_changes, or check_package_provenance to the matching human-authored incident-response playbook (the same content published at /docs/playbooks) and returns its concrete, ordered steps, severity tier, real-incident references, and prevention tips — not just a link. Pass the exact rule string(s) a prior finding already retu
| Parameter | Type | Required | Notes |
|---|---|---|---|
| rules | array | no | 1-10 exact rule values copied from findings already returned by analyze_install_script/check_maintainer_changes/check_package_provenance |
| id | string | no | A playbook slug to look up directly, e.g. "postinstall-binary" — see /docs/playbooks |
Given the same inputs batch_query_vulnerabilities accepts — either a flat {packages:[...]} list, or raw package.json / lockfile / CycloneDX JSON / SPDX JSON content via content — emits a spec-valid CycloneDX 1.6 or SPDX 2.3 JSON document (pick with format, default 'cyclonedx') with npmscan's own OSV.dev vulnerability findings and registry license data embedded in each spec's native fields: Cyc
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | array | no | Explicit package list (1-1000 items, capped to 100 when includeLicenses is on). Use this OR content, not both. |
| content | string | no | Raw dependency inventory content: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, CycloneDX JSON, or SPDX JSON. Use this OR packages, not both. |
| format | string | no | SBOM format to emit. Default 'cyclonedx'. |
| includeDevDependencies | boolean | no | Ignored when using packages; only applies when content is a manifest/lockfile format that distinguishes dev dependencies. |
| includePeerDependencies | boolean | no | Ignored when using packages; only applies when content is a package.json. peerDependencies are excluded by default — set this to also include them as SBOM components. |
| includeVulnerabilities | boolean | no | Query OSV.dev and embed findings natively. Default true. |
| includeLicenses | boolean | no | Resolve registry license data and embed it natively. Default true. |
| policy | object | no | License allow/deny policy, same shape as check_license_compliance. Omit for the default policy. |
| componentName | string | no | Name of the SBOM's own root component/document, if known. |
| componentVersion | string | no | — |
Given the raw output of npm audit --json (npm 7+'s {vulnerabilities: {...}} format, or legacy npm 6's {advisories: {...}}), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same remove-now/patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists (an advisory that is malware — a MAL-* id, or a GH
| Parameter | Type | Required | Notes |
|---|---|---|---|
| content | string | yes | Raw stdout of npm audit --json — either npm 7+ format ({"auditReportVersion": 2, "vulnerabilities": {...}}) or legacy npm 6 format ({"advisories": {...}}). |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install NPMScan or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
—Grade not published
No rule-by-rule report on file for this release
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
This listing is an address its publisher runs, and you connect to it directly — this marketplace is not in the path. The scanner reads packages and public source, and an address is neither. So there is no grade — not a withheld one, an unmeasured one.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 3.1.2.
3.1.2
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish NPMScan can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.