NPMScan

Most tools have clearly distinct purposes and the descriptions explicitly cross-reference each other (e.g. 'use batch_query_vulnerabilities instead when you already have a flat list'). There are a few tightly related clusters — three maintainer tools (check_maintainer_changes/check_maintainer_blast_radius/get_maintainer_profile), three vulnerability-query tools (query_vulnerabilities/batch_query_vulnerabilities/analyze_transitive_dependencies), and get_package vs get_package_version — that require careful reading to pick correctly, but each boundary is documented.

Every tool follows a strict snake_case verb_noun pattern (analyze_install_script, check_license_compliance, get_package_version, query_vulnerabilities, prioritize_remediation). No camelCase or vague verbs appear anywhere in the set.

23 tools is on the heavier side but justified by a genuinely broad domain spanning vulnerability scanning, license compliance, maintainer/provenance analysis, SBOM generation, dependency diffing, and remediation. Nearly every tool earns its place with a distinct function, though the count is near the upper bound of comfortable.

The surface covers the full npm-supply-chain lifecycle: single/batch/transitive vulnerability queries, license compliance, install-script analysis, provenance, maintainer-change and blast-radius detection, SBOM export, remediation prioritization, upgrade simulation, dependency diffing, alternatives, and CVE/advisory lookups. As a read-only analysis server it has no obvious dead ends.