"npm" matching MCP servers:

Model Context Protocol server for npm registry. Enables searching packages, checking security, comparing versions, and validating compatibility.

Audits npm packages for supply-chain attacks (typosquatting, malicious install scripts, credential exfiltration) before installation, returning a SAFE/SUSPICIOUS/DANGEROUS verdict.

Enables AI assistants to manage Nginx Proxy Manager, including proxy hosts, SSL certificates, streams, and more.

Enables conversational management of Nginx Proxy Manager, including reverse-proxy routing, TLS certificates, access lists, and stream forwards, with built-in safety guardrails for production use.

Enables AI agents to interact with the npm registry, covering package intel, dist-tags, trusted publisher configuration, access and team governance, tokens, security advisories, and publishing, with read-only tools by default.

A Model Context Protocol server that enables AI-powered analysis of NPM packages through multiple tools for security vulnerability scanning, dependency analysis, package comparison, and quality assessment.

Enables auditing package.json files for real npm supply-chain attack mechanisms — typosquatted dependency names, malicious preinstall/install/postinstall scripts that pipe downloads into a shell or decode base64 payloads, and unpinned versions — plus live npm registry lookups that flag nonexistent, brand-new, deprecated, or typosquatted packages. It exposes dedicated tools for full manifest audits and single-name typosquat checks.

Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Visual CVE audit dashboard for npm, Python, Go, and Rust projects. Scans your project manifests (package-lock.json, requirements.txt, go.sum, Cargo.lock) against OSV.dev live data, opens a browser dashboard for human review, then applies fixes only after explicit confirmation. Supports multi-service monorepos in one command.

AgentAvow scans any MCP server, package (npm/PyPI/crates/Docker/Hugging Face), or GitHub repo and returns a signed, offline-recomputable 0–100 trust score with a plain safe / needs-review verdict. Authless and read-only, no account.

Verifies npm packages for security risks before installation, checking advisories, install scripts, typosquatting, and other factors, providing safe/block verdicts.

Pre-install risk gate for npm packages. Stops AI coding agents from running malicious or lifecycle scripts run.

An MCP server that provides cross-validated npm dependency fitness verdicts, including deprecation, malicious detection, and safe migration target inference.

Read-only safety checks before an agent acts: scan untrusted text for prompt injection and phishing (locally), check npm packages for malware, hijacked releases and typosquats, scan crypto addresses and tokens, and compare two addresses to catch address poisoning. Zero dependencies.

Enables AI agents and developers to score npm packages, PyPI packages, and GitHub repositories for maintenance health, producing A–F grades, per-signal details, and plain-language risk lists before adoption. It supports checking individual packages, scanning manifests or lock files for transitive dependencies, and comparing alternatives.

Enables AI coding agents to audit Python and npm dependency licenses against your distribution context before shipping, returning CLEAN, REVIEW, or BLOCK verdicts with plain-language reasons and supporting notice generation.

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

An MCP server that scans your lockfiles (npm, PyPI, Go, Rust, Ruby, PHP) for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions. $14/mo — not per-seat.

A wallet for AI agents with spending limits: pays x402 and MPP APIs in USDC (Base, Solana, Algorand) and RLUSD (XRP Ledger), checks every payment with presign-guard first, and asks for approval on your phone above your limits. Source in the wallet-mcp folder; npm: presign-guard-wallet-mcp.