npm Plus runs on your own machine — the client starts it, so there is no endpoint to ping. 43 installs a week from npm. Last commit 10 Mar 2026.
npm MCP — search packages, bundle sizes, vulnerabilities, compare downloads.
Today is the operative word: we check npm Plus every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add npm-plus -- npx -y mcp-server-npm-plus
{
"mcpServers": {
"npm-plus": {
"command": "npx",
"args": [
"-y",
"mcp-server-npm-plus"
]
}
}
}
[mcp_servers.npm-plus]
command = "npx"
args = ["-y", "mcp-server-npm-plus"]
{
"mcpServers": {
"npm-plus": {
"command": "npx",
"args": [
"-y",
"mcp-server-npm-plus"
]
}
}
}
{
"servers": {
"npm-plus": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcp-server-npm-plus"
]
}
}
}
Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes.
Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
OSV.dev (Open Source Vulnerabilities) MCP.
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Check an npm or Python package, or a package.json, for vulnerabilities and upkeep.
Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs
Vulnerability management: scan projects, search sealed packages, manage sealing rules and reports.
Use this MCP server to CISA Known Exploited Vulnerabilities catalog search. Tools include search...
Answers built from our own checks of this server.