mcpbeat

NPMScan MCP Server

io.github.salemalem/npmscan
answering

NPMScan is answering right now. Last checked 1 min ago. It exposes 6 tools.

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

The linked repository no longer exists on GitHub — it was deleted or made private.

Uptime history 39 hours of history
39 hours agonow
100.0%
Uptime 24h
92 of 92 checks
6
Tools
read from the server
240 ms
Response time
average over 24h
open, no key
Access
streamable-http

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 1 min ago.

run in your terminal
claude mcp add npmscan --transport http https://npmscan.com/api/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "npmscan": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.npmscan]
url = "https://npmscan.com/api/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "npmscan": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "npmscan": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

Available tools 6

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

package
get_package
Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page.
get_package_version
Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release.
batch
batch_query_vulnerabilities
Query OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call.
latest
get_latest_advisories
Browse the most recently published, reviewed GitHub Security Advisories for the npm ecosystem, optionally filtered by severity.
packages
search_packages
Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page.
vulnerabilities
query_vulnerabilities
Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package.

Endpoints

URLTransportStateLatencyChecked
https://npmscan.com/api/mcp streamable-http answering 314 ms 1 min ago

NPMScan — questions

Answers built from our own checks of this server.

What can NPMScan do?
It exposes 6 tools, read directly from the server on our last check. Among them: batch_query_vulnerabilities, get_latest_advisories, get_package, get_package_version, query_vulnerabilities, search_packages. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is NPMScan working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 240 ms. The bar chart above shows every period we have measured.
Is NPMScan still maintained?
The linked repository no longer exists on GitHub — it was deleted or made private. We show this because it changes what you can expect: an unmaintained server may keep answering for months and then stop without warning.
How do I connect NPMScan?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does NPMScan need an API key?
No. NPMScan completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 6 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is NPMScan?
It answers our handshake in 240 ms on average, which is faster than 54% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.