mcpbeat Sign in

npm Supply Chain Audit MCP Server

by tylerscomic-lab Your server? Claim it
answering

npm Supply Chain Audit is answering right now. Last checked 3 min ago. Last commit 2 Oct 2026.

Check npm packages for typosquats, hallucinated names, install scripts and risky new releases.

Uptime history 31 days of history · worst day 99%
31 days agonow
100.0%
Uptime 24h
92 of 92 checks
—
Tools
hidden behind auth
524 ms
Response time
average over 24h
0
Stars
last commit 2 Oct 2026

npm Supply Chain Audit missed one check this week

Everything else answered, so this is steady rather than shaky. We check every 15 minutes, which is how a one-off gets told apart from the start of a pattern, and how you hear about the next one within the hour instead of from your users.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 3 min ago.

run in your terminal
claude mcp add npm-supply-chain-audit-mcp --transport http https://npm-supply-chain-audit-mcp.mcpize.run/mcp
Settings → Connectors → Add custom connector, then paste this address
https://npm-supply-chain-audit-mcp.mcpize.run/mcp
~/.codex/config.toml
[mcp_servers.npm-supply-chain-audit-mcp]
url = "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "npm-supply-chain-audit-mcp": {
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "npm-supply-chain-audit-mcp": {
      "type": "http",
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URLTransportStateLatencyChecked
https://npm-supply-chain-audit-mcp.mcpize.run/mcp streamable-http sign-in 248 ms 3 min ago

Alternatives to npm Supply Chain Audit

same job, measured the same way
Pkgtruth
by hxckya

Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

71 installs/wk local only
Safeinstall
by mickdownunder

Local-first supply-chain security gate for npm/pnpm/bun: typosquat, release age, provenance checks

141 installs/wk local only
pkgproof
by pkgproof

Verify an npm or PyPI package before install: advisories, install scripts, typosquats, repository.

138 installs/wk local only
Presend dependency checks
by presendapp

Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.

5 tools answering
Package Guard MCP
by mlawsonking

Supply-chain guard for AI coding agents: verify packages, check vulns/malware, detect typosquats.

82 installs/wk local only
P
pkg-oracle — Dependency Trust Oracle
by julian-martin89

Blocks typosquatted or hallucinated npm/PyPI packages before an AI agent installs them.

1 tools answering
ScriptProbe MCP
by thecompound

ScriptProbe: Check npm install scripts and publisher changes before installing.

local only
Chainsaw package firewall
by chain305

Package firewall for agents: route npm, pip and docker installs through Chainsaw.

answering

npm Supply Chain Audit — questions

Answers built from our own checks of this server.

Why is there no tool list for npm Supply Chain Audit?
The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.
Is npm Supply Chain Audit working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 524 ms. The bar chart above shows every period we have measured.
How do I connect npm Supply Chain Audit?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.
How do you sign in to npm Supply Chain Audit?
No API key is involved. npm Supply Chain Audit answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.
How fast is npm Supply Chain Audit?
It answers our handshake in 524 ms on average, which is faster than 22% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.
Is npm Supply Chain Audit open source?
The code is open source: it is published under the MIT licence, written in JavaScript and 0 stars on GitHub. The licence covers the code in the repository, not the hosted service at npm-supply-chain-audit-mcp.mcpize.run, which runs on its operator's own terms.