Provides a comprehensive set of tools for managing npm packages, allowing AI assistants to publish packages, bump versions, search the registry, perform security audits, and manage project dependencies directly through the npm registry.
npm-mcp
MCP server that lets AI assistants manage npm packages. Publish, version, search, audit, install, and more -- all through Claude Code or any MCP client.
When to Use
Task | Tool |
"Publish this package to npm" |
|
"Check for outdated dependencies" |
|
"Run a security audit on my packages" |
|
"Search npm for authentication libraries" |
|
"Bump the version and publish" |
|
"Check who owns this npm package" |
|
"View download stats for my package" |
|
For AI agents: See
llms.txtfor a machine-readable summary. Copytemplates/CLAUDE.mdortemplates/AGENTS.mdinto your project to teach your agent about this MCP.
Why
You're in Claude Code building a library. You finish the code, and now you need to publish it. Instead of switching to a terminal:
You: publish this package to npm with public access
Claude: [calls publish tool] Published @yourorg/lib@1.0.0 successfullyThat's it. No context switching.
Setup
1. Install
git clone https://github.com/mikusnuz/npm-mcp.git
cd npm-mcp
npm install
npm run build2. Get npm token
Go to npmjs.com > Account > Access Tokens > Generate New Token (Automation type recommended).
3. Add to Claude Code
Edit ~/.claude/settings.json:
{
"mcpServers": {
"npm-mcp": {
"command": "node",
"args": ["/path/to/npm-mcp/dist/index.js"],
"env": {
"NPM_TOKEN": "npm_xxxxxxxxxxxx"
}
}
}
}Or if you've already run npm login locally, skip NPM_TOKEN -- it uses your ~/.npmrc automatically.
Tools
Publishing & Versioning
Tool | Description |
| Publish a package to npm registry |
| Bump package version (patch/minor/major/pre*) |
| Remove a package version |
| Deprecate a version (or undeprecate with empty message) |
| Preview what would be published |
Package Info
Tool | Description |
| View package info from registry |
| Search npm registry |
| Get bug tracker URL for a package |
| Get repository URL for a package |
| Get documentation URL for a package |
| Show diff between package versions |
Dependency Management
Tool | Description |
| Install packages |
| Remove packages |
| Update packages to latest semver-compatible version |
| Check for outdated packages |
| List installed packages |
| Explain why a package is installed |
| Reduce duplication in dependency tree |
| Remove extraneous packages |
| Show funding info for dependencies |
| Query packages using CSS-like selectors |
Security & Diagnostics
Tool | Description |
| Run security audit (with optional auto-fix) |
| Generate Software Bill of Materials (CycloneDX/SPDX) |
| Check npm environment health |
| Check registry connectivity |
Configuration & Auth
Tool | Description |
| Check current authenticated user |
| Manage access tokens (list/revoke) |
| Set or view access level on packages |
| Manage package owners (ls/add/rm) |
| Manage distribution tags (ls/add/rm) |
| View or modify npm profile settings |
| View npm configuration (read-only) |
Project Setup
Tool | Description |
| Initialize a new package.json |
| Manage package.json fields programmatically |
| Clean install from lockfile (for CI) |
| Run scripts defined in package.json |
| Symlink a local package for development |
| Manage the npm cache |
Examples
Publish a scoped package:
publish({ path: "/home/user/my-lib", access: "public" })Bump version and publish:
version({ path: "/home/user/my-lib", bump: "patch" })
publish({ path: "/home/user/my-lib" })Check what's inside before publishing:
pack({ path: "/home/user/my-lib", dryRun: true })Search for existing packages:
search({ query: "react state management", limit: 5 })View package details:
view({ package: "@yourorg/lib", field: "versions" })Install packages:
install({ path: "/home/user/my-app", packages: ["express", "cors"], saveDev: false })Check outdated dependencies:
outdated({ path: "/home/user/my-app" })Compare versions:
diff({ specs: ["lodash@4.17.20", "lodash@4.17.21"] })Generate SBOM:
sbom({ path: "/home/user/my-app", format: "spdx", production: true })Query dependencies:
query({ path: "/home/user/my-app", selector: ":root > .prod" })Auth
Method | How |
NPM_TOKEN (recommended) | Set |
npm login | Run |
For 2FA-enabled accounts, pass otp parameter to publish/unpublish/deprecate/owner/access/token tools.
Environment Variables
Variable | Default | Description |
| -- | npm authentication token |
|
| Path to npm binary (if not in PATH) |
License
MIT