M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionCodebase MemoryA codebase knowledge graph for AI coding agents.NPM Sentinel MCP ServerAI-powered NPM package analysis MCP server
FMRS52 / 100 · D79 / 100 · B
Reliability8 / 2012 / 20
Security and permissions12 / 2016 / 20
Maintenance10 / 2018 / 20
Documentation13 / 2018 / 20
Setup experience9 / 2015 / 20
Best for
  • AI coding agents that need local code intelligence.
  • Teams requiring cross-file call resolution, architecture analysis, or incremental indexing.
  • Users who prefer a pure-C stdio server with local persistent storage.
  • Developers auditing NPM dependencies within AI workflows
  • Teams performing supply chain security assessments
  • Users of Claude Desktop, Cursor, or VS Code
Not for
  • Users requiring a built-in large language model or cloud-hosted code analysis.
  • Users unable to build from source or provide a C/C++ build environment.
  • Clients requiring SSE or streamable-http transport.
  • Projects outside the NPM ecosystem (e.g., pure Python/Go)
  • Environments without network access to deps.dev, OSV.dev, and the npm registry
  • Scenarios requiring maintenance by an official upstream vendor
Required permissions
  • Read access to the repositories and Git changes being indexed.
  • Local write access for the SQLite graph database and configuration in the cache directory.
  • When installing or configuring supported agents, write access to agent configuration, instruction files, skills, and hooks.
  • Write access to Architecture Decision Records when managing ADRs.
  • Network access to the NPM registry and external services (deps.dev, OSV.dev, OpenSSF, npms.io, GitHub)
  • Read access to workspace lockfiles (pnpm-lock.yaml, package-lock., yarn.lock) for cache invalidation
Risks and side effects
  • The tool reads the codebase and may write to agent configuration files.
  • The fork has no prebuilt binaries; building compiles many vendored grammars.
  • Do not run the binary's update subcommand because it pulls the official upstream release and overwrites the integrated build.
  • Deleting a project or local cache removes the corresponding graph data, but not the source code.
  • Third-party READMEs and changelogs are untrusted external content; they are wrapped in tags with _meta flags but should still be handled cautiously
  • Depends on availability and accuracy of external services
  • Batch requests are capped at 25 packages to prevent registry enumeration; larger sets require batching
  • Third-party open source project, not officially maintained by NPM or Anthropic
Supported clientsClaude Code, Codex, Gemini CLI, Zed, OpenCode, Antigravity, Aider, KiloCode, VS Code, OpenClaw, KiroClaude Desktop, VS Code, Cursor
Tools1519