NPMScan

The descriptions are unusually thorough and explicitly cross-reference each other (e.g. 'use batch_query_vulnerabilities instead when you already have a flat list', 'use get_package/get_package_version first'), which resolves most confusion. However, several tools overlap on the same job: query_vulnerabilities, batch_query_vulnerabilities, get_package, get_package_version, analyze_transitive_dependencies, and audit_github_repository all perform OSV vulnerability checks, and get_maintainer_profile/check_maintainer_changes/check_maintainer_blast_radius all touch maintainers. The boundaries are documented but still require careful reading to pick correctly.

Every tool is snake_case and follows a verb_noun pattern (analyze_install_script, get_package, check_license_compliance, batch_query_vulnerabilities, prioritize_remediation, simulate_dependency_upgrade). The verb variety is meaningful rather than chaotic, and no camelCase/snake_case mixing occurs.

At 23 tools this sits in the heavy range for a single server. The domain (comprehensive npm supply-chain security) is genuinely broad, so most tools earn their place, but the count is inflated by several overlapping OSV-query and maintainer-inspection tools that could plausibly be consolidated.

The surface covers the full security lifecycle: package/version metadata, single and batch vulnerability queries, transitive-graph analysis, repo auditing, lockfile diffing, license compliance, maintainer/provenance checks, SBOM generation, CVE/advisory browsing, remediation prioritization, upgrade simulation, and alternative suggestions. There are no obvious dead ends for the stated domain.