"npm" matching MCP servers:

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Visual CVE audit dashboard for npm, Python, Go, and Rust projects. Scans your project manifests (package-lock.json, requirements.txt, go.sum, Cargo.lock) against OSV.dev live data, opens a browser dashboard for human review, then applies fixes only after explicit confirmation. Supports multi-service monorepos in one command.

Translates a lockfile diff into a human-readable upgrade plan. For every dependency bump (npm or PyPI) returns semver class, breaking changes from GitHub release notes, CVEs fixed in the range, migration guide links, and a clear per-package recommendation. Bulk tool ranks up to 50 package changes in parallel by risk (security > caution > review > likely-safe > safe).

Audits local package folders to generate publish-readiness reports and previews of NPM tarball contents. It helps developers identify and resolve configuration issues like missing types or broken exports before releasing code.

Scores npm packages, PyPI packages and GitHub repositories 0-100 with an A-F grade and plain-language risks. Scans package.json, requirements.txt and lock files; no API key needed.

Deterministic motion compiler + validator for AI-generated web apps: validated MotionSpec JSON compiles to reduced-motion-safe GSAP/CSS. Reports WCAG 2.2.2 pause-path candidates; missing reduced-motion guards flagged as 2.3.3/AAA best practice. Keyless read-only MCP tools: motion_catalog + motion_validate; compile/audit/stats need a key (full toolset free locally: npx motionspec). MIT core on npm.

Automatically scans project dependencies (npm, Composer) for security vulnerabilities using the OSV.dev database, providing real-time alerts and detailed remediation guidance directly in your IDE.

Godot 4 MCP server with: Test running (GUT/GdUnit4) with structured pass/fail results API docs search with 30+ Godot 3→4 migration mappings Script analysis detecting 10 common GDScript pitfalls Scene/resource file parsing with antipattern detection Viewport screenshot capture LSP diagnostics from Godot's language server TypeScript, cross-platform (macOS/Windows/Linux), published on npm

Lightweight Node.js dependency vulnerability audit tool with CLI and MCP Server modes. Supports npm/pnpm, full dependency chain tracing, remote GitHub repo auditing, and generates Markdown/HTML reports.

Enables measuring DOM elements and capturing screenshots in a real local Chrome browser over the DevTools Protocol, with in-page login so httpOnly cookies apply and overlay-masking before capture. It removes common Chrome automation traps such as sandbox kills, WebSocket origin rejection, and Retina pixel scaling, with no npm or Python dependencies beyond the MCP SDK.

DocGuard, an official, zero-dependency Node.js MCP server (npm: docguard-cli, docguard mcp) exposing 5 read-only doc-governance tools: guard, score, explain, verify-claims, diagnose.

Enables coding agents to run Playwright e2e tests, validate Supabase RLS policies with role-based SQL, typecheck TypeScript, execute npm scripts with parsed test output, and validate Next.js builds, all through a structured MCP interface.

An AI-powered security audit tool that analyzes codebases for vulnerabilities using real-time MITRE CWE data and npm audit. It enables users to perform comprehensive scans for authentication issues, exposed secrets, and dependency risks with structured remediation steps.

An AI-powered security audit tool that analyzes codebases for vulnerabilities using real-time data from MITRE CWE and npm audit. It enables deep analysis of authentication, API security, and dependencies to provide structured findings and remediation steps.

Enables checking npm packages for known security vulnerabilities using the OSV API before installation. Supports both single package checks and bulk vulnerability scanning for multiple packages at once.

Enables security scanning for npm dependencies by checking manifest and lockfiles against the OSV.dev and Socket.dev vulnerability databases. It provides tools to detect vulnerabilities in specific packages and retrieve detailed technical reports for identified security issues.

A collection of MCP servers distributed as a single npm package, including mcp-visualizer which uses Puppeteer for screenshots, typing, and network/console diagnostics on any web framework.

Enables AI agents to drive a Playwright-compatible browser (with humanized mouse, keyboard, and scroll behavior, persistent profiles, extensions, and GeoIP-aware proxies) to research the web, automate daily tasks, and run tests, with unchanged upstream @playwright/mcp tools plus two local introspection tools. It installs via npm or Docker and speaks stdio or Streamable HTTP.

Enables AI agents to perform Playwright-compatible browser automation with persistent profiles, Chrome extension support, proxy matching, humanized input, and npm/Docker deployment over stdio or Streamable HTTP.

It enables AI agents to control real Chromium browsers through Playwright-compatible tools for web research, automation, and testing, with stdio or Streamable HTTP transport and npm or Docker deployment.