"npm" matching MCP tools:

• npm-package-factsA

  SALT19 Agent Utility GridB

  Return live npm registry facts for the latest or requested package version without the higher-priced vulnerability and adoption decision layer. Price: $0.01 via x402. _salt19_operation_id is recommended but optional for standard x402 compatibility.

  ConnectorNo auth

• npm-packagesA

  Agent Data ToolsA

  Look up one exact npm package including scoped names, latest version, license, publication times and capped dependency metadata. No maintainers, users, contacts, README, tarball or download calls. Price: $0.01 USDC per successful call on Base. Requires an x402-capable wallet client.

  ConnectorNo auth

• npm-package-intelA

  SALT19 Agent Utility GridB

  Check whether an npm package is deprecated or vulnerable before installing it, including vulnerabilities, license, maintenance, freshness, dependency health, and package.json risk signals. Price: $0.05 via x402. Generate one _salt19_operation_id per intended purchase, preserve it across retries, and add _x402_payment_signature after satisfying the challenge. A stable _salt19_operation_id is required and makes semantic retries at-most-once. _salt19_operation_id is recommended but optional for standard x402 compatibility.

  ConnectorNo auth

• npm-i-checkerB

  e18eB

  Check for outdated or insecure npm packages in an install script like `npm i` or `pnpm add` or `yarn add` or `bun i`.

  ConnectorNo auth

• purl-npmC

  pkg:npm package-url shape, value discardedC

  pkg:npm package-url shape, value discarded

  ConnectorNo auth

• x402-npm-auditC

  minia2a-mcpD

  x402-npm-audit: NPM package security audit. 🆓 5 free trial calls per signed wallet

  ConnectorNo auth

• x402-npm-auditC

  minia2a-mcp-remoteC

  x402-npm-audit: NPM package security audit. 🆓 5 free trial calls per signed wallet

  ConnectorNo auth

• npm-name-shapeC

  npm Name ShapeC

  Check an npm package name shape. Name discarded.

  ConnectorNo auth

• x402-npm-package-infoB

  minia2a-mcpD

  Npm Package Info: Looks up an npm package and returns its latest version, description, license, and repository 🆓 5 free trial calls per signed wallet

  ConnectorNo auth

• x402-npm-package-infoB

  minia2a-mcp-remoteC

  Npm Package Info: Looks up an npm package and returns its latest version, description, license, and repository 🆓 5 free trial calls per signed wallet

  ConnectorNo auth

• search_packagesA

  devstack-mcpA

  Search a registry for packages matching q. registry=all fans out to npm, Docker Hub, and the VS Code Marketplace and merges the results. PyPI has no public search API, so registry=pypi returns 400 not_supported — look a PyPI package up by name via get_package instead. Results are normalized PackageSummary items (npm adds a relevance score; Docker adds isOfficial).

  ConnectorNo auth

• server.describeA

  Agent402.Tools: pay-per-call web toolsA

  [free] Describe this connector: flagship-first tools layer (search/answer as the front door), how to install (Claude Code / Cursor / npm), free vs paid tiers, and discovery URLs. Call this first.

  ConnectorNo auth

• enrich_npm_auditA

  NPMScanA

  Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same remove-now/patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists (an advisory that is malware — a MAL-* id, or a GHSA whose OSV record carries CWE-506 / a MAL-* alias — is auto-detected and forces remove-now). npm audit's JSON almost never includes a CVE id (only a GHSA advisory URL), so this resolves each GHSA to its CVE alias via OSV.dev when one exists (ghsaResolvedToCveCount reports how many) before doing the same CISA KEV + FIRST.org EPSS + severity scoring — skipping this step would silently degrade most findings to severity-only ranking despite prioritize_remediation being built around CVE-keyed KEV/EPSS data. Also carries through npm-audit-specific context prioritize_remediation itself has no field for: isDirect (direct vs. transitive dependency) and fixAvailable/fixTarget (npm's own computed fix — note fixTarget can name a different package than the vulnerable one, e.g. bumping a parent to pull in a patched transitive dependency). A package with more than one distinct advisory in the source report only has its first advisory used for ranking; a warning names the package so query_vulnerabilities can be called on it directly for the rest. `yarn audit --json` and `pnpm audit --json` use different report shapes and are not supported — use batch_query_vulnerabilities with the project's manifest/lockfile for those instead.

  ConnectorNo auth

• enrich_npm_auditA

  NPMScanA

  Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same remove-now/patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists (an advisory that is malware — a MAL-* id, or a GHSA whose OSV record carries CWE-506 / a MAL-* alias — is auto-detected and forces remove-now). npm audit's JSON almost never includes a CVE id (only a GHSA advisory URL), so this resolves each GHSA to its CVE alias via OSV.dev when one exists (ghsaResolvedToCveCount reports how many) before doing the same CISA KEV + FIRST.org EPSS + severity scoring — skipping this step would silently degrade most findings to severity-only ranking despite prioritize_remediation being built around CVE-keyed KEV/EPSS data. Also carries through npm-audit-specific context prioritize_remediation itself has no field for: isDirect (direct vs. transitive dependency) and fixAvailable/fixTarget (npm's own computed fix — note fixTarget can name a different package than the vulnerable one, e.g. bumping a parent to pull in a patched transitive dependency). A package with more than one distinct advisory in the source report only has its first advisory used for ranking; a warning names the package so query_vulnerabilities can be called on it directly for the rest. `yarn audit --json` and `pnpm audit --json` use different report shapes and are not supported — use batch_query_vulnerabilities with the project's manifest/lockfile for those instead.

  ConnectorNo auth

• supply_chain_checkA

  Presend MCP ServerA

  Call this before installing or adding a package (npm install, pip install, a new entry in a manifest), especially one whose name you recalled or that a model suggested. One-call risk check: combines vulnerability_check (OSV.dev), typosquat_check, maintainer_change_check (npm only) and repo_health_check (when the GitHub repo can be resolved) into one overall verdict. A package that does not exist on npm or PyPI gets overall_risk 'package_not_found': the name may be invented and should not be installed. A package first published less than 30 days ago gets the 'new_package' flag and overall_risk 'review_recommended': new packages are where invented and look-alike names get registered, so the name is worth confirming against the project's own documentation before installing (on PyPI the age is that of the oldest release still published; being new does not make a package malicious). Use the individual tools to investigate one signal. Vulnerabilities are checked for the given version, or the latest published one (version_checked, version_source). If a check could not run (rate limit, upstream error), it is listed in unavailable_checks and overall_risk is 'incomplete', never 'no_signals_found'. Also flags a version marked deprecated on npm or yanked on PyPI.

  ConnectorNo auth

• recommend_reposA

  whichlibA

  Find the best open-source library for a need before adding a dependency. Give the need in plain words and get up to `limit` GitHub repositories ranked by fit = score x relevance to the need. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this when you do not yet have candidates; use compare_repos when you already have names. Makes 3 GitHub searches plus npm/PyPI lookups for the shortlist. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

  ConnectorNo auth

• trending_reposA

  whichlibA

  Discover projects: the most-starred GitHub repositories created in the last day, week or month, or with period "rising" repositories of any age that gained the most stars this week (like GitHub Trending; risingRank keeps that order). Optionally one language; each scored and returned sorted by score (starsRank keeps the stars order). Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Not the right tool for picking a dependency, since new repositories have little maintenance history; use recommend_repos for that. One GitHub search (rising: one download of the daily list from raw.githubusercontent.com instead), plus one npm/PyPI lookup per repository when withDownloads is true. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

  ConnectorNo auth

• supply_chain_checkA

  Presend dependency checksA

  Call this before installing or adding a package (npm install, pip install, a new entry in a manifest), especially one whose name you recalled or that a model suggested. One-call risk check: combines vulnerability_check (OSV.dev), typosquat_check, maintainer_change_check (npm only) and repo_health_check (when the GitHub repo can be resolved) into one overall verdict. A package that does not exist on npm or PyPI gets overall_risk 'package_not_found': the name may be invented and should not be installed. A package first published less than 30 days ago gets the 'new_package' flag and overall_risk 'review_recommended': new packages are where invented and look-alike names get registered, so the name is worth confirming against the project's own documentation before installing (on PyPI the age is that of the oldest release still published; being new does not make a package malicious). Use the individual tools to investigate one signal. Vulnerabilities are checked for the given version, or the latest published one (version_checked, version_source). If a check could not run (rate limit, upstream error), it is listed in unavailable_checks and overall_risk is 'incomplete', never 'no_signals_found'. Also flags a version marked deprecated on npm or yanked on PyPI.

  ConnectorNo auth

• packageA

  Agent Data ToolsA

  Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency. Example: ecosystem=npm, name=lodash. Price $0.002/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

  ConnectorNo auth

• packageA

  Agent Data Tools: Compliance and checksA

  Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency. Example: ecosystem=npm, name=lodash. Price $0.002/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

  ConnectorNo auth

• packageA

  Agent Data Tools: Company, compliance and checksA

  Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency. Example: ecosystem=npm, name=lodash. Price $0.002/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

  ConnectorNo auth