"npm" matching MCP servers:

Model Context Protocol server for npm registry. Enables searching packages, checking security, comparing versions, and validating compatibility.

Audits npm packages for supply-chain attacks (typosquatting, malicious install scripts, credential exfiltration) before installation, returning a SAFE/SUSPICIOUS/DANGEROUS verdict.

Enables AI assistants to manage Nginx Proxy Manager, including proxy hosts, SSL certificates, streams, and more.

Enables conversational management of Nginx Proxy Manager, including reverse-proxy routing, TLS certificates, access lists, and stream forwards, with built-in safety guardrails for production use.

Enables AI agents to interact with the npm registry, covering package intel, dist-tags, trusted publisher configuration, access and team governance, tokens, security advisories, and publishing, with read-only tools by default.

A Model Context Protocol server that enables AI-powered analysis of NPM packages through multiple tools for security vulnerability scanning, dependency analysis, package comparison, and quality assessment.

Pre-install risk gate for npm packages. Stops AI coding agents from running malicious or lifecycle scripts run.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Visual CVE audit dashboard for npm, Python, Go, and Rust projects. Scans your project manifests (package-lock.json, requirements.txt, go.sum, Cargo.lock) against OSV.dev live data, opens a browser dashboard for human review, then applies fixes only after explicit confirmation. Supports multi-service monorepos in one command.

An MCP server that provides cross-validated npm dependency fitness verdicts, including deprecation, malicious detection, and safe migration target inference.

An MCP server that scans your lockfiles (npm, PyPI, Go, Rust, Ruby, PHP) for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions. $14/mo — not per-seat.

Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

Verifies which domain officially belongs to a software product, AI tool, or company, so the agent stops handing users lookalike download sites. Ownership only, never safety. Every verdict is backed by reproducible evidence; results carry the sentence the agent should say. Tools: get_official_url(name), verify_url(url). npm: @realurls/mcp; remote endpoint: https://api.realurls.org/mcp

Automatically scans project dependencies (npm, Composer) for security vulnerabilities using the OSV.dev database, providing real-time alerts and detailed remediation guidance directly in your IDE.

Lightweight Node.js dependency vulnerability audit tool with CLI and MCP Server modes. Supports npm/pnpm, full dependency chain tracing, remote GitHub repo auditing, and generates Markdown/HTML reports.

Tenant-bound MCP server for agent spend authorization, policy guardrails, evidence, escrow settlement, and portable receipts. Works with Cursor and Claude Code via stdio; npm (@paybond/kit) and Python (paybond-kit).

MCP security trust layer. Continuously monitors 800+ MCP packages on npm for install scripts, command injection, hardcoded secrets, capability drift, and publisher posture. Ships a GitHub Action policy gate for PR-level allow/warn/block decisions. 5 MCP tools, no API key required.

Verifies npm package names for safety, detecting typosquats and nonexistent packages before your coding agent installs them.

The MCP ecosystem is growing fast. Not every server on npm is safe. mcp-shield lets Claude audit any MCP server — local or from npm — before you trust it with your files, keys, and context.