"npm" matching MCP servers:

MCP server that manages npm run dev processes, automatically detecting projects, running them in the background, monitoring logs, and managing ports.

MCP server for npm login, publishing, and viewing package operations.

Retrieves documentation for any npm package by automatically discovering its GitHub repository and returning its README.md content.

Pre-install risk gate for npm packages. Stops AI coding agents from running malicious or lifecycle scripts run.

Enables AI coding agents to search the npm registry and retrieve package metadata, READMEs, download stats, GitHub details, and usage snippets via the Model Context Protocol.

Enables MCP-compatible AI applications to perform read-only npm package and project dependency safety scans, returning proceed, caution, or block verdicts without executing package code.

Enables AI agents to work with the npm registry across multiple named accounts, routing each call to the right token based on an explicit account, a matching package scope, or the default. Offers read tools for search, package details, downloads and account listing, plus confirmation-guarded write tools for publishing, deprecating and managing dist-tags.

An MCP server that wraps NVM (Node Version Manager) to give Antigravity agents full control over Node.js versions without requiring Node or npm to be on the system PATH. It provides tools to install, switch between, and run commands with different Node versions directly within agent workflows.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Official SQAI MCP server: governed structured data access powered by Mojo kernels. 3 stdio tools: listSources (discovery), queryData (deterministic read-only queries + compute with provenance), explainQuery (dry-run validation). Introspection needs no credentials; execution requires a one-time free sqai login. npm: @thyn-ai/sqai-mcp. Source: packages/mcp. Registry: io.github.thyn-ai/sqai.

Lets AI agents scaffold modern npm packages, CLIs, HTTP services, and apps as a native tool. Three tools: inspect the full option/preset schema, preview the generated file tree for a config, and write the project to disk.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Visual CVE audit dashboard for npm, Python, Go, and Rust projects. Scans your project manifests (package-lock.json, requirements.txt, go.sum, Cargo.lock) against OSV.dev live data, opens a browser dashboard for human review, then applies fixes only after explicit confirmation. Supports multi-service monorepos in one command.

Local MCP runtime that gives persistent cross-session memory to 12 AI coding agents (Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Amp, and more). SQLite-backed state survives context resets. Install: npm install -g @egchq/egc

Detects breaking changes in a TypeScript library's public API and recommends the semver bump, comparing two npm releases, git refs or a working tree. Each finding is graded proven or review-only.

Enables AI agents to run persistent Node.js REPL sessions that preserve state across evaluations, supporting top-level await, module loading, and per-session npm package installation.

Provides npm/PyPI package intelligence including health scores, vulnerabilities, dependency graphs, and download counts via an MCP server, with optional pay-per-call access over x402 for advanced health and batch endpoints.

Audits local package folders to generate publish-readiness reports and previews of NPM tarball contents. It helps developers identify and resolve configuration issues like missing types or broken exports before releasing code.

Enables AI agents and developers to score npm packages, PyPI packages, and GitHub repositories for maintenance health, producing A–F grades, per-signal details, and plain-language risk lists before adoption. It supports checking individual packages, scanning manifests or lock files for transitive dependencies, and comparing alternatives.