Best for
- Developers auditing NPM dependencies within AI workflows
- Teams performing supply chain security assessments
- Users of Claude Desktop, Cursor, or VS Code
N
NPM Sentinel MCP Server
Community
AI-powered NPM package analysis MCP server
GitHub source repository ↗
79FMRS · B
A comprehensive NPM package analysis MCP server with 19 tools covering security, dependencies, quality, and trends, featuring OWASP LLM01 defenses, dual output protocol, and dual-era protocol compatibility — well suited to security-conscious development teams.
NPM Sentinel MCP is a Model Context Protocol server offering 19 tools for recursive security scanning, dependency tree analysis, download trends, quality scoring, and alternative suggestions. It leverages Google deps.dev, OSV.dev, OpenSSF Scorecard, and npms.io data, supports both STDIO and Streamable HTTP transports, and includes defenses against indirect prompt injection (OWASP LLM01) plus automatic cache invalidation on lockfile changes.
Tools
npmLatest
Get latest version info, release dates, SRI integrity hashes, and dist-tags.
npmVersions
Get full version history with release dates and deprecation statuses.
npmDeps
Complete dependency tree and transitive graph analysis via deps.dev.
npmTypes
Check TypeScript support (native declarations vs @types packages).
npmSize
Analyze bundle size, minified size, and gzip impact.
npmVulnerabilities
Transitive vulnerability scanning via deps.dev and OSV.dev.
npmTrends
Historical download stats over week/month/year ranges.
npmCompare
Side-by-side metric comparison across multiple packages.
npmMaintainers
List maintainers, public emails, and publishing activity.
npmScore
Consolidated quality, popularity, maintenance, and OpenSSF Scorecard score.
npmPackageReadme
Retrieve full raw README markdown from the NPM registry.
npmSearch
Search NPM packages by query with rich metadata.
npmLicenseCompatibility
Analyze license compatibility across multiple packages.
npmRepoStats
GitHub repository stats combined with OpenSSF Scorecard checks.
npmDeprecated
Detect deprecation status on packages and recursive sub-dependencies.
npmChangelogAnalysis
Extract release notes and GitHub release history.
npmAlternatives
Suggest functional alternatives while filtering ecosystem plugins.
npmQuality
Package code quality score (0–1).
npmMaintenance
Package maintenance activity score (0–1).
Setup
Run via npx: add a server entry to your Claude Desktop or VS Code/Cursor MCP config with command npx -y @nekzus/mcp-server@latest. Also available via Docker, by mounting createMcpHttpHandler from @nekzus/mcp-server/http on Cloudflare Workers, Hono, Express, or similar platforms, or via the Smithery.ai hosted URL. Configure the registry with the NPM_REGISTRY_URL environment variable.
claude_desktop_config.json
{"mcpServers":{"npm-sentinel":{"command":"npx","args":["-y","@nekzus/mcp-server@latest"]}}}
Fit and risk
Not for
- Projects outside the NPM ecosystem (e.g., pure Python/Go)
- Environments without network access to deps.dev, OSV.dev, and the npm registry
- Scenarios requiring maintenance by an official upstream vendor
Required permissions
- Network access to the NPM registry and external services (deps.dev, OSV.dev, OpenSSF, npms.io, GitHub)
- Read access to workspace lockfiles (pnpm-lock.yaml, package-lock., yarn.lock) for cache invalidation
Risks and side effects
- Third-party READMEs and changelogs are untrusted external content; they are wrapped in tags with _meta flags but should still be handled cautiously
- Depends on availability and accuracy of external services
- Batch requests are capped at 25 packages to prevent registry enumeration; larger sets require batching
- Third-party open source project, not officially maintained by NPM or Anthropic
Troubleshooting
- Verify the npx command runs directly in a terminal and Node is installed
- Check the NPM_REGISTRY_URL environment variable configuration
- Use ignoreCache: true to force fresh lookups when cached data appears stale
- Cache should auto-invalidate on lockfile changes; otherwise bypass manually
- For STDIO connection failures, verify client config JSON syntax
Use cases
Assessing NPM package security and vulnerabilities before adoption
Analyzing dependency trees and transitive dependencies
Comparing candidate packages on quality and maintenance
Tracking download trends and bundle sizes
Finding functional alternatives to existing packages
Supported clients
Claude DesktopFull support
VS CodeFull support
CursorFull support
Smithery.aiFull support