"npm" matching MCP servers:

Audits npm packages for supply-chain attacks (typosquatting, malicious install scripts, credential exfiltration) before installation, returning a SAFE/SUSPICIOUS/DANGEROUS verdict.

MCP server providing npm registry search, package details, dependency auditing, bundle size estimation, and package comparison tools for AI agents.

A Model Context Protocol server that enables AI-powered analysis of NPM packages through multiple tools for security vulnerability scanning, dependency analysis, package comparison, and quality assessment.

An MCP server for searching, inspecting, and evaluating NPM packages through health scoring and license risk assessments. It provides comprehensive package analysis including maintenance status, popularity trends, and security vulnerability reports to help users make informed dependency decisions.

MCP server for npm — search packages, check bundle sizes, scan vulnerabilities, compare downloads, inspect dependencies.

MCP server that provides npm package information for AI agents during TypeScript development.

Enables auditing package.json files for real npm supply-chain attack mechanisms — typosquatted dependency names, malicious preinstall/install/postinstall scripts that pipe downloads into a shell or decode base64 payloads, and unpinned versions — plus live npm registry lookups that flag nonexistent, brand-new, deprecated, or typosquatted packages. It exposes dedicated tools for full manifest audits and single-name typosquat checks.

Enables AI-powered JavaScript package management including search, install, update, remove, and security auditing across npm, yarn, and pnpm.

AI-powered code assistant that provides advanced search and discovery capabilities across GitHub and NPM ecosystems, helping users understand code patterns, implementations, and connections between repositories.

Enables AI agents to prospect across GitHub, PyPI, and npm, searching repositories, packages, and code patterns with read-only tools.

AgentAvow scans any MCP server, package (npm/PyPI/crates/Docker/Hugging Face), or GitHub repo and returns a signed, offline-recomputable 0–100 trust score with a plain safe / needs-review verdict. Authless and read-only, no account.

Verifies npm packages for security risks before installation, checking advisories, install scripts, typosquatting, and other factors, providing safe/block verdicts.

Detects breaking changes in a TypeScript library's public API and recommends the semver bump, comparing two npm releases, git refs or a working tree. Each finding is graded proven or review-only.

Provides npm/PyPI package intelligence including health scores, vulnerabilities, dependency graphs, and download counts via an MCP server, with optional pay-per-call access over x402 for advanced health and batch endpoints.

Audits local package folders to generate publish-readiness reports and previews of NPM tarball contents. It helps developers identify and resolve configuration issues like missing types or broken exports before releasing code.

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

Provides the real exported API surface and type signatures of any npm package, extracted from its published TypeScript declarations, enabling AI coding agents to use functions accurately and avoid inventing nonexistent APIs.

MCP server that audits npm dependencies against the live registry, providing per-dependency reports on versions behind, deprecation, and license.

Enables checking packages across npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems for existence, deprecation, known vulnerabilities, and license issues before installation, providing verdicts like does_not_exist, risky, verify, or ok.

Package intelligence for AI coding agents that checks npm and PyPI package health, deprecation, vulnerabilities, bundle size, and compares alternatives.