"npm" matching MCP servers:

Model Context Protocol server for npm registry. Enables searching packages, checking security, comparing versions, and validating compatibility.

Enables AI assistants to track weekly npm package download trends, growth rates, and rankings for market and developer ecosystem research.

MCP server to search npm packages, view details, compare, check downloads, and inspect dependencies.

A Model Context Protocol server that enables AI-powered analysis of NPM packages through multiple tools for security vulnerability scanning, dependency analysis, package comparison, and quality assessment.

Provides weekly download counts and trend data for npm packages, enabling comparison of adoption velocity across JavaScript libraries.

MCP server for npm — search packages, check bundle sizes, scan vulnerabilities, compare downloads, inspect dependencies.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Read-only on-chain query surface for the AgentCivics civil registry on Sui — soulbound AI-agent identities, on-chain memories, reputation, refusal records. Hosted, no install, no keypair. For write tools (register, write_memory, record_refusal), install the npm package @agentcivics/mcp-server locally and supply your own keypair.

Official SQAI MCP server: governed structured data access powered by Mojo kernels. 3 stdio tools: listSources (discovery), queryData (deterministic read-only queries + compute with provenance), explainQuery (dry-run validation). Introspection needs no credentials; execution requires a one-time free sqai login. npm: @thyn-ai/sqai-mcp. Source: packages/mcp. Registry: io.github.thyn-ai/sqai.

A Model Context Protocol server that provides AI coding agents with real, live, source-cited documentation for npm, PyPI, and Cargo packages, including READMEs, metadata, vulnerability checks, and package search.

AI-powered code assistant that provides advanced search and discovery capabilities across GitHub and NPM ecosystems, helping users understand code patterns, implementations, and connections between repositories.

A universal MCP aggregator toolkit that connects AI agents to multiple MCP servers through a single unified configuration. Features ready-made templates, cross-repo prompt workflows, and an npm package for zero-config installation.

Check whether a CLI command name is already taken across npm, PyPI, crates.io, Go, Debian and more

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Explains known developer errors offline and deterministically (CORS, ESM/CommonJS, npm ERESOLVE, Next.js builds, Postgres connection and DATABASE_URL errors). One tool, explain_error; no LLM, no network.

AgentAvow scans any MCP server, package (npm/PyPI/crates/Docker/Hugging Face), or GitHub repo and returns a signed, offline-recomputable 0–100 trust score with a plain safe / needs-review verdict. Authless and read-only, no account.

Verifies npm packages for security risks before installation, checking advisories, install scripts, typosquatting, and other factors, providing safe/block verdicts.

Translates a lockfile diff into a human-readable upgrade plan. For every dependency bump (npm or PyPI) returns semver class, breaking changes from GitHub release notes, CVEs fixed in the range, migration guide links, and a clear per-package recommendation. Bulk tool ranks up to 50 package changes in parallel by risk (security > caution > review > likely-safe > safe).