Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Average 4.2/5 across 6 of 6 tools scored.
Most tools have clear distinct purposes: searching, fetching package metadata, and querying vulnerabilities. However, query_vulnerabilities and batch_query_vulnerabilities both query OSV, differing only in scale, while get_package and get_package_version both fetch registry metadata, which could cause minor confusion.
All tool names follow a consistent verb_noun pattern in lowercase snake_case: get_package, get_package_version, query_vulnerabilities, batch_query_vulnerabilities, search_packages, get_latest_advisories. The pattern is uniform and predictable.
Six tools is well-scoped for an npm security scanning server. Each tool covers a distinct aspect of the workflow: searching, fetching package details, querying vulnerabilities, and browsing advisories, without unnecessary redundancy.
The tool set covers core workflows: search packages, inspect metadata, query known vulnerabilities, and scan multiple packages at once. Minor gaps exist, such as no direct tool to retrieve a full npmscan.com risk report or detailed dependency analysis, but the provided links and OSV queries cover the main security scanning needs.
batch_query_vulnerabilitiesBatch query known vulnerabilitiesAQuery OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call.
| Name | Required | Description | Default |
|---|---|---|---|
| packages | Yes | 1-100 packages to check |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false, covering the safety profile. The description adds value by naming the external source (OSV.dev) and the batch limit (up to 100, also in schema), but does not disclose return format, error behavior, or rate limits. With annotations present, this is acceptable but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that states the function, scope, and use case efficiently. Every phrase earns its place, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple one-parameter tool with rich schema, clear annotations, and a focused description. The description fully covers purpose, scale, and ideal usage scenario, making it complete for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with a clear description of the 'packages' array ('1-100 packages to check'). The description adds domain context (npm, package.json/lockfile) but does not provide additional syntax or format details. Baseline 3 is appropriate since the schema handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Query OSV.dev for known vulnerabilities'), the resource ('npm packages'), and the batch scope ('up to 100 at once'). It distinguishes itself from likely sibling 'query_vulnerabilities' by emphasizing batch processing and the specific use case of scanning a package.json/lockfile.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context ('ideal for scanning a whole package.json/lockfile in one call') that implies this tool is for batch queries. However, it does not explicitly state when to use a single-query sibling or when not to use this tool, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_latest_advisoriesGet latest npm security advisoriesABrowse recently published, reviewed GitHub Security Advisories for the npm ecosystem. Filter by severity, vulnerability category (XSS, SQL/NoSQL Injection, SSRF, Access Control, Code Injection, etc.), an affected package name, or look up one exact advisory by GHSA or CVE ID. Paginated with an opaque cursor: pass a previous response's nextCursor back in as cursor to fetch the next page.
| Name | Required | Description | Default |
|---|---|---|---|
| cveId | No | Look up one exact advisory by its CVE ID (e.g. "CVE-2024-12345") | |
| cursor | No | Opaque pagination cursor from a previous response's nextCursor, to fetch the next page | |
| ghsaId | No | Look up one exact advisory by its GHSA ID (e.g. "GHSA-xxxx-xxxx-xxxx") | |
| affects | No | Filter to advisories affecting this npm package name | |
| category | No | Filter by vulnerability category. One of: access-control, dos, xss, ssrf, auth, code-injection, info-exposure, path-traversal, input-validation, prototype-pollution, command-injection, sqli, crypto, race-condition, open-redirect, csrf, crlf-injection, xml-injection, malicious-code, deserialization | |
| severity | No | Filter by severity (default all) | |
| direction | No | Sort by published date, newest or oldest first (default desc) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false. The description adds useful behavioral context: pagination via an opaque cursor with nextCursor, and the 'reviewed' status of advisories. It does not describe the full response fields or error cases, but the added details go beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences: the first states purpose, the second enumerates filtering options, and the third explains pagination. Every sentence earns its place, and the structure is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, multiple filtering modes, no output schema), the description covers the key usage aspects, including pagination mechanics. However, it could be more complete by describing the response shape or what fields are returned for each advisory.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by summarizing filters in natural language and clarifying exact lookup semantics by GHSA or CVE ID, which complements the schema descriptions and helps the agent understand how the parameters interrelate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('browse') and resource ('recently published, reviewed GitHub Security Advisories for the npm ecosystem'), with explicit filter capabilities and exact lookup by GHSA/CVE. This distinguishes it from the sibling 'query_vulnerabilities' by focusing on the latest advisories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear use cases: browse recent advisories, filter by severity/category/package, or look up a specific advisory by GHSA/CVE, with pagination. It does not explicitly mention when not to use this tool or name alternatives, so there are no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_packageGet npm package detailsAFetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact npm package name, e.g. "lodash" or "@scope/name" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is a safe read-only operation (readOnlyHint=true, destructiveHint=false). The description adds useful context about the returned metadata (including install scripts as a risk signal) and the inclusion of a link to the npmscan.com analysis page, which goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences. The first sentence front-loads the main verb and resource, then lists specific metadata fields. The second sentence mentions the link to the analysis page. No redundant or filler content exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a single parameter, clear schema, and annotations confirming read-only safety, the description is quite complete. It lists the key return fields and the external link. However, because there is no output schema, the description could be slightly more explicit about the response format or pagination, though it's adequate for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides a clear description of the single 'name' parameter with examples and length constraints (100% coverage). The description does not add additional meaning about the parameter beyond what is in the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Fetch') and resource ('npm registry metadata') and lists concrete fields (latest version, install scripts, maintainers, license, version history). This clearly differentiates it from sibling get_package_version, which focuses on a specific version.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for inspecting package metadata and highlights install scripts as a risk signal, which suggests a security analysis context. However, it does not explicitly state when to use this tool over siblings like get_package_version or search_packages, so the guidance remains implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_package_versionGet a specific npm package versionAFetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact npm package name | |
| version | Yes | Exact version string, e.g. "4.17.21" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=true and non-destructive. Description adds behavioral context by enumerating the registry metadata fields returned (dependencies, install scripts, tarball), which complements the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states the action and return contents, second provides usage context. No redundant wording, all details earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter, read-only tool with strong annotations, the description fully captures purpose, return contents, and appropriate use case. No output schema exists, but the metadata listing gives adequate return expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema descriptions already cover both parameters with exact names and examples (schema coverage 100%). Description adds minimal extra meaning beyond emphasizing 'exact version' and lockfile context, but the schema carries the semantic load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it fetches registry metadata for one exact package version, listing specific metadata (dependencies, install scripts, tarball). Distinguishes from sibling tools by explicitly contrasting with the latest release use case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance: checking a version pinned in a lockfile. Contrasts with fetching the latest release, implying an alternative tool. This satisfies the 'when/when-not' criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_vulnerabilitiesQuery known vulnerabilities for a packageAQuery OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | npm package name | |
| version | No | Optional exact version to narrow results | |
| ecosystem | No | OSV ecosystem, default "npm" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false. The description adds that the tool queries OSV.dev (an external service) and can be version-scoped, which is useful context. However, it does not describe the response format, potential rate limits, or behavior beyond what annotations already cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the key action and resource, followed by a concise usage note. Every word earns its place—no redundancy, fluff, or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and well-covered by schema and annotations. The description provides the essential purpose and usage context. There is no output schema, but the return type ('known vulnerabilities') is implied, and for a read-only query this is sufficient. It could mention the batch alternative, but that is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the schema already documents name, version, and ecosystem with descriptions. The description's references to 'npm package' and 'one version' simply restate the schema. No additional semantic meaning is provided beyond the structured definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the exact action ('Query OSV.dev'), the resource ('known vulnerabilities affecting an npm package'), and the optional scope ('optionally scoped to one version'). It clearly distinguishes from sibling tools like batch_query_vulnerabilities by focusing on a single package.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage guidance: 'Use before recommending or installing a package.' This gives clear context for when to invoke the tool. However, it does not mention alternatives (e.g., batch_query_vulnerabilities for multiple packages), so it lacks the exclusions needed for a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_packagesSearch npm packagesASearch the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results to return (default 20, max 50) | |
| query | Yes | Search text, e.g. a package name or keywords |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds useful behavioral context by stating it returns matching packages with a link to a full risk/analysis page, which is beyond the annotations. It does not detail pagination or sorting, but given the simple tool and annotation coverage, this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences with front-loaded action. The first sentence states the core purpose, the second adds valuable return-behavior detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with no output schema, the description adequately covers what it does, what it returns (matching packages and a link), and the resource (npm registry). Annotations cover safety, and siblings are differentiated. No significant gaps for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description's phrase 'by name or keywords' adds minimal value beyond the schema's parameter description for 'query'. The 'limit' parameter is not mentioned, but the schema fully documents it. Thus no significant additional meaning is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Search') and resource ('npm registry'), and clarifies scope ('by name or keywords'). It clearly distinguishes from sibling tools like get_package and query_vulnerabilities by focusing on package search rather than exact lookup or vulnerability queries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: search for packages by name or keywords. It does not explicitly state when not to use it or name alternatives, but the context is clear and distinct from siblings. No exclusions are mentioned, which is acceptable for a straightforward search tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
hey guys
