NPMScan

Query known vulnerabilities for a package

query_vulnerabilities

Read-only

Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile is safe). Returns isVulnerable and highestSeverity as a direct answer, plus each finding's severity, a plain-language summary, CVE aliases, and the fixedVersion to upgrade to — not a raw advisory dump. Also cross-checks the name/version against the npm registry: isVulnerable:false on a package that does not actually exist there (typo, wrong ecosystem) would otherwise look identical to a genuinely clean result — see packageExists/existenceCheckNote. A name or version not found on the registry does NOT discard already-fetched OSV data or short-circuit into an error: OSV/GHSA advisory data is independent of the package's current registry listing, and a package/version pulled from npm for being malicious (unpublished/yanked) is exactly the case where real vulnerability data must still be reported, not hidden behind a 404. Use before recommending, installing, or upgrading a package.

Input Schema

TableJSON Schema

Name	Required	Description
`name`	Yes	npm package name
`version`	No	Optional exact version to narrow results, e.g. to check one version pinned in a lockfile
`ecosystem`	No	OSV ecosystem, default "npm"

Output Schema

TableJSON Schema

Name	Required	Description	Default
`package`	Yes
`version`	Yes
`npmscanUrl`	Yes
`isVulnerable`	Yes
`packageExists`	Yes
`highestSeverity`	Yes
`vulnerabilities`	Yes
`existenceCheckNote`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedSep 8, 2026

addedOutput schema / properties / existenceCheckNote

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / packageExists

Added value: +{
+  "type": [
+    "boolean",
+    "null"
+  ]
+}

changedOutput schema / required

Previous value: -[
-  "package",
-  "version",
-  "npmscanUrl",
-  "isVulnerable",
-  "highestSeverity",
-  "vulnerabilities"
-]New value: +[
+  "package",
+  "version",
+  "npmscanUrl",
+  "packageExists",
+  "existenceCheckNote",
+  "isVulnerable",
+  "highestSeverity",
+  "vulnerabilities"
+]

Changed16 schema fields changedSep 1, 2026

changedInput schema / properties / version / description

Previous value: -"Optional exact version to narrow results"New value: +"Optional exact version to narrow results, e.g. to check one version pinned in a lockfile"

addedOutput schema / properties / highestSeverity

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / isVulnerable
```
Added value: +{
+  "type": "boolean"
+}
```

addedOutput schema / properties / version

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

changedOutput schema / properties / vulnerabilities / items / additionalProperties
```
Previous value: -trueNew value: +false
```
removedOutput schema / properties / vulnerabilities / items / properties / details
```
Removed value: -{
-  "type": "string"
-}
```
addedOutput schema / properties / vulnerabilities / items / properties / fixedVersion
```
Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}
```
removedOutput schema / properties / vulnerabilities / items / properties / modified
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / vulnerabilities / items / properties / published
```
Removed value: -{
-  "type": "string"
-}
```
addedOutput schema / properties / vulnerabilities / items / properties / publishedAt
```
Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}
```

removedOutput schema / properties / vulnerabilities / items / properties / references

Removed value: -{
-  "items": {
-    "additionalProperties": false,
-    "properties": {
-      "type": {
-        "type": "string"
-      },
-      "url": {
-        "type": "string"
-      }
-    },
-    "required": [
-      "url"
-    ],
-    "type": "object"
-  },
-  "type": "array"
-}

removedOutput schema / properties / vulnerabilities / items / properties / severity / items

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "score": {
-      "type": "string"
-    },
-    "type": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "type",
-    "score"
-  ],
-  "type": "object"
-}

changedOutput schema / properties / vulnerabilities / items / properties / severity / type
```
Previous value: -"array"New value: +[
+  "string",
+  "null"
+]
```
changedOutput schema / properties / vulnerabilities / items / properties / summary / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```

changedOutput schema / properties / vulnerabilities / items / required

Previous value: -[
-  "id"
-]New value: +[
+  "id",
+  "summary",
+  "severity",
+  "aliases",
+  "publishedAt",
+  "fixedVersion",
+  "npmscanUrl"
+]

changedOutput schema / required

Previous value: -[
-  "package",
-  "npmscanUrl",
-  "vulnerabilities"
-]New value: +[
+  "package",
+  "version",
+  "npmscanUrl",
+  "isVulnerable",
+  "highestSeverity",
+  "vulnerabilities"
+]

Changed1 schema field changedSep 1, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "npmscanUrl": {
+      "type": "string"
+    },
+    "package": {
+      "type": "string"
+    },
+    "vulnerabilities": {
+      "items": {
+        "additionalProperties": true,
+        "properties": {
+          "aliases": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "details": {
+            "type": "string"
+          },
+          "id": {
+            "type": "string"
+          },
+          "modified": {
+            "type": "string"
+          },
+          "npmscanUrl": {
+            "type": "string"
+          },
+          "published": {
+            "type": "string"
+          },
+          "references": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "type": {
+                  "type": "string"
+                },
+                "url": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "url"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          },
+          "severity": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "score": {
+                  "type": "string"
+                },
+                "type": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "type",
+                "score"
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          },
+          "summary": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "package",
+    "npmscanUrl",
+    "vulnerabilities"
+  ],
+  "type": "object"
+}

First observedAug 1, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state readOnly/openWorld/non-destructive hints. The description adds critical non-obvious behavior: it cross-checks the npm registry and exposes packageExists/existenceCheckNote to distinguish a nonexistent package from a genuinely clean result. It also explicitly says that a registry 404 does not discard OSV data or become an error, covering the malicious-unpublished-package edge case.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but each item earns its place: core query behavior, result shape, registry cross-check, edge-case handling, and a usage directive. It is front-loaded with the primary purpose and output contract before nuanced caveats. It is dense but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only query tool with an output schema and helpful annotations, the description covers the full call context: what it checks, what it returns, how to interpret isVulnerable:false, and when to use it. The registry edge-case explanation is especially valuable and hard to discover otherwise. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers all three parameters, so the description does not need to repeat basics. It adds useful semantic context, such as checking a lockfile-pinned version, the npm default for ecosystem, and the fact that name/version feed the registry cross-check. This is a meaningful bonus over the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource ('Query OSV.dev for known vulnerabilities affecting an npm package') and adds an explicit scope qualifier ('optionally scoped to one exact version'). The description also contrasts itself with 'a raw advisory dump,' helping an agent distinguish it from sibling tools like get_cve or batch_query_vulnerabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit trigger: 'Use before recommending, installing, or upgrading a package,' which tells an agent the decision context. It also describes what the tool is not for ('not a raw advisory dump') and explains the registry cross-check behavior. It does not explicitly name sibling alternatives for bulk queries, but the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All NPMScan tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?