"npm" matching MCP servers:

Enables MCP-compatible AI applications to perform read-only npm package and project dependency safety scans, returning proceed, caution, or block verdicts without executing package code.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Security scanner for vibe coders that checks npm packages for known vulnerabilities before installation, integrating with AI coding tools like Claude Code and Cursor.

Enables auditing npm, pip, and other package dependencies for known CVEs via the OSV database, with tools to scan manifests, query individual packages, and integrate into CI/CD workflows.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories to surface dependency vulnerabilities. Exposes a tool that supports severity thresholds, registry overrides, optional dev-dependency skipping, and text or JSON reports.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories for dependency vulnerabilities, with configurable severity thresholds, dev-dependency skipping, and text or JSON reporting.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories for vulnerabilities, with configurable thresholds, registry, dev-dependency skipping, retries, and text or JSON report output.

Exposes an assess_repo tool that scans a repository, local folder, or npm/PyPI package and returns supply-chain risk findings with file, line, and code evidence — install-time scripts, dangerous patterns, secrets, AI-agent manipulation, impersonation and published-artifact mismatches — while never executing the target's code. Findings carry severities from info to critical so results can gate installs and CI jobs.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories through an MCP tool, returning vulnerability results in text or JSON with configurable thresholds and dev dependency skipping.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories via an MCP tool, returning vulnerability results in text or JSON with configurable thresholds, registry, dev-dependency skipping, and retries.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories through an MCP tool, returning vulnerability results with configurable thresholds, registry, dev-dependency skipping, retries, and text or JSON output.

npm audit for MCP servers. Point it at an MCP server and get a security grade (A–F) covering missing auth, SSRF surface, high-privilege tools, prompt-injection-prone tool descriptions, and leaked secrets.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories, returning vulnerability results in text or JSON with configurable thresholds and dev dependency skipping.

Enables auditing of npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories (including private ones) through a stdio MCP tool, returning unified vulnerability results filtered by severity threshold in text or JSON. It supports custom registries, optional skipping of dev dependencies, audit retries, and Chinese or English reports.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories and returning unified vulnerability reports with configurable severity thresholds, dev-dependency skipping, and text or JSON output.

This MCP server enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories, returning vulnerability reports in text or JSON with configurable severity thresholds and dev-dependency filtering.

Enables auditing npm, Yarn, and pnpm lockfiles from local directories or remote Git repositories through an MCP tool, returning vulnerability results in text or JSON with configurable thresholds and optional dev dependency skipping.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories, returning vulnerability results in text or JSON with configurable thresholds and dev-dependency skipping.