Which integrations are available for this server?

Enhances rate limits for npm API requests through a GitHub token, improving performance and reliability when performing multiple package lookups. Provides tools to look up npm package versions and perform security signal analysis, enabling AI assistants to check package up-to-dateness and detect suspicious indicators.

How do I use pkg-booper?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@pkg-booper check latest version of axios" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

pkg-booper

by FennecOnTheNet

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

pkg-booper

Boop your dependencies' snoots.

An MCP server that gives AI assistants tools to check up-to-date npm package versions, as well as gleaning other security heuristics. It's not a super comprehensive analysis, just a lil' snoot boop.

What is this?

pkg-booper is a Model Context Protocol (MCP) server that provides npm package intelligence for AI-assisted development. It fills the gap where documentation tools exist but version/health checking doesn't.

Key features:

Quick version lookups for any npm package
Security signal analysis using transparent indicators
Batch analysis of entire package.json files
Caching for fast repeated lookups

Related MCP server: pkgguard

Installation

Run directly with npx:

npx pkg-booper

Or install globally:

npm install -g pkg-booper
pkg-booper

MCP Client Configuration

Claude Desktop

Add to your Claude Desktop configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "pkg-booper": {
      "command": "npx",
      "args": ["-y", "pkg-booper"]
    }
  }
}

Cursor

Add to your Cursor MCP settings (.cursor/mcp.json):

{
  "mcpServers": {
    "pkg-booper": {
      "command": "npx",
      "args": ["-y", "pkg-booper"]
    }
  }
}

Claude Code

Add to your Claude Code MCP settings file (.mcp.json):

{
  "mcpServers": {
    "pkg-booper": {
      "command": "npx",
      "args": ["-y", "pkg-booper"]
    }
  }
}

Cline

Add to your Cline MCP settings:

{
  "mcpServers": {
    "pkg-booper": {
      "command": "npx",
      "args": ["-y", "pkg-booper"]
    }
  }
}

Tools

pkg-booper-boop

Quick version lookup for an npm package.

Input:

{
  "package": "lodash",
  "skipCache": false
}

Output:

{
  "success": true,
  "package": "lodash",
  "latest": "4.17.21",
  "tags": {
    "latest": "4.17.21"
  },
  "summary": "lodash@4.17.21"
}

pkg-booper-sniff

Signal-based security analysis of an npm package. Returns information that lets the AI reason about the combination of indicators.

Input:

{
  "package": "express",
  "version": "4.18.2",
  "compareVersions": true,
  "skipCache": false
}

Output:

{
  "success": true,
  "package": "express",
  "version": "4.18.2",
  "facts": {
    "age": { "days": 4500, "created": "2010-12-29" },
    "lastPublish": { "days": 180, "version": "4.18.2" },
    "weeklyDownloads": 30000000,
    "maintainerCount": 3,
    "versionCount": 275,
    "hasTypes": true,
    "hasRepository": true
  },
  "definitiveIndicators": [],
  "behavioralSignals": [],
  "info": ["Popular package: 30M weekly downloads"],
  "summary": "express@4.18.2: No concerning signals detected"
}

Signal Categories:

definitiveIndicators: Critical security issues (malware markers, deprecated status)
behavioralSignals: Patterns that warrant investigation (new package, single maintainer, suspicious scripts)
info: Neutral observations (popularity, age, features)

pkg-booper-big-sniff-file

Batch analyze all dependencies from a package.json file.

Input:

{
  "path": "/path/to/package.json",
  "includeDevDependencies": true,
  "skipCache": false
}

Output:

{
  "success": true,
  "packageJsonPath": "/path/to/package.json",
  "results": {
    "lodash": { "success": true, "package": "lodash", "..." },
    "express": { "success": true, "package": "express", "..." }
  },
  "summary": {
    "total": 15,
    "clean": 14,
    "suspicious": 1,
    "outdated": 3,
    "definiteThreats": 0,
    "failed": 0
  },
  "humanSummary": "Analyzed 15 packages: 14 clean, 1 suspicious, 0 threats"
}

pkg-booper-big-sniff-list

Batch analyze a provided list of dependencies.

Input:

{
  "dependencies": {
    "lodash": "^4.17.21",
    "express": "^4.18.2",
    "axios": "^1.6.0"
  },
  "skipCache": false
}

Output: Same format as pkg-booper-big-sniff-file.

pkg-booper-clear-cache

Clear cached npm package data.

Input:

{
  "package": "lodash",
  "type": "all"
}

package: Optional. Clear cache for specific package, or omit for all.
type: "all" | "versions" | "health" | "popular"

Output:

{
  "success": true,
  "cleared": ["lodash:versions", "lodash:health"],
  "summary": "Cleared 2 cache entries for lodash"
}

Configuration

pkg-booper can be configured via YAML files, environment variables, or programmatic overrides.

Configuration File Locations

Files are checked in this order (first found wins):

PKG_BOOPER_CONFIG environment variable path
./pkg-booper.yaml (project directory)
~/.config/pkg-booper/config.yaml (user config)

Example Configuration

# pkg-booper.yaml
cache:
  directory: ~/.cache/pkg-booper
  ttl: 86400  # 24 hours in seconds
  popularPackagesTtl: 604800  # 7 days for popular packages

thresholds:
  levenshtein: 2  # Typosquat detection sensitivity
  lowDownloads: 100  # Weekly downloads below this trigger a signal

scoring:
  weights:
    maturity: 0.15
    popularity: 0.25
    maintenance: 0.25
    trust: 0.25
    completeness: 0.10

github:
  token: ${GITHUB_TOKEN}  # Interpolates from environment

timeout: 10000  # Request timeout in ms

rateLimit:
  npm:
    requestsPerSecond: 10
  github:
    requestsPerMinute: 30

debug: false

Environment Variables

Variable	Description	Default
`GITHUB_TOKEN`	GitHub API token for enhanced rate limits	-
`PKG_BOOPER_CONFIG`	Path to custom config file	-
`PKG_BOOPER_CACHE_DIR`	Cache directory	`~/.cache/pkg-booper`
`PKG_BOOPER_CACHE_TTL`	Cache TTL in seconds	`86400`
`PKG_BOOPER_TIMEOUT`	Request timeout in ms	`10000`
`PKG_BOOPER_DEBUG`	Enable debug logging	`false`

Examples

AI Assistant Usage

User: "What's the latest version of React?"

AI uses pkg-booper-boop:

React is currently at version 18.2.0.

User: "Analyze the security of this package.json"

AI uses pkg-booper-big-sniff-file:

I analyzed 23 dependencies:
- 21 packages look clean
- 2 packages have behavioral signals worth noting:
  - some-package: New package (< 30 days old), single maintainer
  - another-pkg: Significantly outdated (2 major versions behind)

No definitive threats detected, but you may want to review the flagged packages.

User: "Is 'lod-ash' a legit package?"

AI uses pkg-booper-sniff:

Warning: 'lod-ash' appears to be a typosquat of 'lodash':
- Very similar name (Levenshtein distance: 1)
- Much lower download count than lodash
- Created recently compared to lodash

I'd recommend using the official 'lodash' package instead.

License

This is licensed under the AGPLv3.

Why? I feel like information deserves to be free. Code is a sort of information, and I know the AGPL is pretty good at encouraging sharing. That, and I think of the code I put together with the help of generative AI less like an original composition, and more like a silly mashup.

I don't feel comfortable publishing my mashups under anything less open ;)

Available Tools

5 tools

pkg-booper-big-sniff-fileC

Batch analyze all dependencies from a package.json file for security signals

Inputs: path (required), skipCache, includeDevDependencies.

pkg-booper-big-sniff-listC

Batch analyze a provided list of dependencies for security signals

Inputs: dependencies (required), skipCache.

pkg-booper-boopC

Look up the latest version and dist-tags for an npm package

Inputs: package (required), skipCache.

pkg-booper-clear-cacheB

Clear cached npm package data. Optionally filter by package name or cache type (versions, health, popular)

Inputs: type, package.

pkg-booper-sniffC

Analyze an npm package for security signals, facts, and indicators

Inputs: package (required), version, skipCache, compareVersions.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

TDQS

B3.2/5.0

Scored 2026-09-13 08:15 across 5 tools

Disambiguation4/5

boop (version lookup) and sniff (security analysis) are clearly distinct, and clear-cache is unambiguous. The only overlap is big-sniff-file vs big-sniff-list, which differ solely by input source (package.json vs provided list), though the descriptions do clarify the boundary.

Naming Consistency4/5

All tools use the same kebab-case, pkg-booper- prefixed pattern, which is highly consistent. However the actionable verbs are playful and non-self-documenting (boop, sniff, big-sniff), so the scheme is predictable but not transparently descriptive.

Tool Count5/5

Five tools are well-scoped for an npm lookup-and-security-inspection server, with no filler. Each tool maps to a distinct capability (version lookup, single analysis, two batch modes, cache management).

Completeness4/5

The surface covers version lookup, single/batch security analysis, and cache control, forming a coherent lifecycle. Minor gaps exist around per-package detail (license, maintainers, diff/compare) that agents might want but can work around.

Maintenance

ActivityInactive

ResponsivenessOutdated data

Resources

Related MCP Connectors

Nekzus-npm-sentinel-mcp
ai.smithery
Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…
Developer Tools Monitoring Security
218
https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp
UNPKGA
io.github.unpkg
Live npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks.
Developer Tools Security Code Analysis
1411
https://mcp.unpkg.com/mcp
Presend dependency checksA
io.github.presendapp
Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.
Security Developer Tools
511
https://presend.pages.dev/mcp-deps
NPMScanA
io.github.salemalem
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Security Code Analysis Developer Tools
1
https://npmscan.com/api/mcp

Related MCP Servers

Dependency Freshness MCP
Developer Tools CI/CD & DevOps
Armigerous
A
license
A
quality
C
maintenance
Checks npm and PyPI packages for outdated versions, deprecation status, and breaking changes with cited sources, enabling AI agents to verify dependency freshness.
Updated 5 months ago (2026-06-12 20:34 UTC)
1
6 npm
ISC
pkgguard
Developer Tools Security
kiansaeidnia
A
license
Not graded
quality
C
maintenance
Enables AI coding agents to automatically verify npm packages against the live registry before installation, flagging hallucinated, slopsquatted, or otherwise suspicious packages with risk verdicts.
Updated 2 months ago (2026-08-30 06:31 UTC)
5 npm
MIT
pkgtruth
Security CI/CD & DevOps Developer Tools
hxckya
A
license
A
quality
B
maintenance
Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.
Updated 4 days ago (2026-11-09 11:16 UTC)
3
67 npm
4
MIT
@mgcrea/mcp-npm
Developer Tools Security
mgcrea
A
license
A
quality
B
maintenance
Enables AI agents to interact with the npm registry, covering package intel, dist-tags, trusted publisher configuration, access and team governance, tokens, security advisories, and publishing, with read-only tools by default.
Updated 13 days ago (2026-10-31 11:17 UTC)
3
22 npm
MIT

pkg-booper

What is this?

Installation

MCP Client Configuration

Claude Desktop

Cursor

Claude Code

Cline

Tools

pkg-booper-boop

pkg-booper-sniff

pkg-booper-big-sniff-file

pkg-booper-big-sniff-list

pkg-booper-clear-cache

Configuration

Configuration File Locations

Example Configuration

Environment Variables

Examples

AI Assistant Usage

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Dependency Freshness MCP

pkgguard

pkgtruth

@mgcrea/mcp-npm