Skip to main content
Glama
mgcrea

@mgcrea/mcp-npm

by mgcrea
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Remote

Server Quality Checklist

67%
Profile completionA complete profile improves this server's visibility in search results.

  • Latest release: v0.1.0

  • Disambiguation5/5

    The two tools have entirely distinct purposes: one reports authentication/configuration state, the other checks package versions against security advisories. An agent cannot plausibly confuse them when selecting a tool.

    Naming Consistency4/5

    Both names share the `npm_` prefix and use snake_case, which makes them feel cohesive. However, `npm_audit_dependencies` is verb-object while `npm_auth_status` is noun-noun, a minor deviation from a fully parallel naming convention.

    Tool Count3/5

    With only two tools, the server sits at the thin end of the typical range. Each tool is substantive, but an npm-focused server would usually need more surface area to feel well-scoped.

    Completeness2/5

    The pair gives a useful auth diagnostic and a security audit, but leaves no action path for an agent—there are no package lookup, publish, or remediation tools. The auth status tool also references write and trusted-publisher capabilities that are not exposed, leaving a significant gap for a server called npm.

  • Average 4.5/5 across 2 of 2 tools scored.

    See the Tool Scores section below for per-tool breakdowns.

    • No community issues in the last 6 months
    • No commit activity data available
    • Last stable release on
    • No critical vulnerability alerts
    • No high-severity vulnerability alerts
    • No code scanning findings
    • CI is passing

  • This repository is licensed under MIT License.

  • This repository includes a README.md file.

  • No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.

    Tip: use the "Try in Browser" feature on the server page to seed initial usage.

  • Add a glama.json file to provide metadata about your server.

  • If you are the author, simply .

    If the server belongs to an organization, first add glama.json to the root of your repository:

    {
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}

    Then . Browse examples.

  • Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

  • Behavior4/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    The readOnlyHint annotation already signals a safe read. The description adds valuable behavioral nuance beyond that: that a missing sibling tool should be interpreted as a configuration gap, not a bug, and that the `trusted_publishing_available` field can answer capability questions 'without spending a call.' This makes the tool's role and interpretation explicit.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is two sentences, front-loaded with the core reporting function, then gives targeted diagnostic guidance. No wasted words; every sentence adds information about what the tool reveals or when to use it.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    For a zero-parameter, read-only status tool, the description covers the main output areas and even names a key field (`trusted_publishing_available`) and its `blockers` list. Slight gap: no full response format is given, and with no output schema, a bit more detail on response shape would make it fully self-contained. Still, the essentials are present.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters4/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    There are zero parameters, and the input schema is empty, so there is nothing for the description to add at the parameter level. The description correctly focuses on outputs and usage rather than inventing parameter detail. A zero-parameter tool earns the baseline score of 4.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description begins with a precise verb and object: 'Report what this server can and cannot do,' then enumerates the exact dimensions covered (token configuration, account, 2FA, write access, cached OTP). This is unmistakably an auth/status diagnostic tool and leaves no ambiguity about its role relative to the sibling audit tool.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines4/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    It gives explicit guidance: 'Call this first when a tool you expected is missing — an absent tool means missing configuration rather than a bug.' It also instructs when to consult specific output fields, which is actionable. There are no alternatives or exclusions, but the diagnostic context is clear enough to warrant a 4.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior5/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Beyond the readOnlyHint annotation, the description discloses meaningful behavior: it returns only packages with advisories, it strips the `references` field for size, and the `url` field remains as the pointer to the write-up. It also explicitly notes no token is needed, which is valuable operational context.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is concise and well-structured: it opens with the core function, then explains input format, operational prerequisite, and a notable output transformation. Every sentence contributes useful information without redundancy.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness5/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    For a one-parameter, read-only tool with no output schema, the description adequately covers what input is expected, what the output will contain (only affected packages), and one important field behavior that would otherwise be a surprise. An agent can confidently invoke this tool without needing more context.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    The schema has 100% coverage and already explains the format, gives an example, and warns that exact versions (not ranges) are required. The description's phrase 'flat map of package name to the versions you have installed' simply repeats the schema's meaning without adding new semantics, so the baseline 3 is appropriate.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description states a specific verb ('Check') and resource ('package versions against npm's security advisories'), and ties it to the familiar `npm audit` command. The topic is clearly distinct from the sibling `npm_auth_status`, which is about authentication state, not dependency auditing.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines4/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    It gives clear context: this is a direct query of npm's advisory data, and it requires no npm token, so it works on an unconfigured server. It doesn't explicitly mention the sibling as an alternative, but the sibling's purpose is obviously different, so an agent can infer when to use this tool.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

  • Confirm that the MCP server is working as expected.
  • Confirm that there are no obvious security issues.
  • Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

mcp-npm MCP server

Copy to your README.md:

Score Badge

mcp-npm MCP server

Copy to your README.md:

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/mgcrea/mcp-npm'

If you have feedback or need assistance with the MCP directory API, please join our Discord server