NPM Sentinel MCP Server

Community

AI-powered NPM package analysis MCP server

How to install ↓ Compare GitHub source repository ↗

Category: Dev Tools #2 of 438
Stars: ★ 18 Popular
Transport: stdio (local process) · Streamable HTTP
Runtime: Node.js · Docker
Credentials: No credential needed
License: MIT
Last commit: 59 days ago
Tools: 19

79FMRS · B

A comprehensive NPM package analysis MCP server with 19 tools covering security, dependencies, quality, and trends, featuring OWASP LLM01 defenses, dual output protocol, and dual-era protocol compatibility — well suited to security-conscious development teams.

Strongest · Documentation 18/20 Weakest · Reliability 12/20

Reliability

12/20

Security and permissions

16/20

Maintenance

18/20

Documentation

18/20

Setup experience

15/20

Why each score

Reliability 12/20: The project demonstrates solid architectural design with complete MCP v2 implementation and dual-protocol compatibility. From the source code, it uses TypeScript and defines comprehensive input/output schemas. However, static analysis cannot verify actual runtime behavior, and no complete test suite covering key paths is visible, justifying a conservative score.
Security and permissions 16/20: The project implements multiple security layers including input validation, batch size limits, prototype pollution protection, and indirect prompt injection defense. It marks external content with XML tags and metadata, and implements OWASP LLM01 compliance. No obvious security vulnerabilities or excessive permission requests were identified.
Maintenance 18/20: The project shows active maintenance status with regular releases, clear version control, and complete CI/CD pipeline. Dependencies are updated, license is clear, and there's明确的维护者. GitHub shows continuous integration workflows and Docker support.
Documentation 18/20: Documentation is comprehensive, including detailed installation guides, configuration options, tool descriptions, and usage examples. It clearly explains security measures, performance considerations, and limitations. Provides configuration examples for different platforms (VS Code, Claude Desktop, Docker, etc.).
Setup experience 15/20: Installation is straightforward with multiple deployment options (STDIO, HTTP, Docker). The project provides clear configuration instructions for different clients and implements one-click installation via npx. However, some advanced configurations may require additional technical knowledge.

Static review · not runListed 2026-09-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

Developers auditing NPM dependencies within AI workflows
Teams performing supply chain security assessments
Users of Claude Desktop, Cursor, or VS Code

Not for

Projects outside the NPM ecosystem (e.g., pure Python/Go)
Environments without network access to deps.dev, OSV.dev, and the npm registry
Scenarios requiring maintenance by an official upstream vendor

Required permissions

Network access to the NPM registry and external services (deps.dev, OSV.dev, OpenSSF, npms.io, GitHub)
Read access to workspace lockfiles (pnpm-lock.yaml, package-lock., yarn.lock) for cache invalidation

Risks and side effects

Third-party READMEs and changelogs are untrusted external content; they are wrapped in tags with _meta flags but should still be handled cautiously
Depends on availability and accuracy of external services
Batch requests are capped at 25 packages to prevent registry enumeration; larger sets require batching
Third-party open source project, not officially maintained by NPM or Anthropic

Setup

Before you start

Runtime：Node.js · Docker

Other optional settings (1)

NPM_REGISTRY_URL optional Optional; overrides the NPM registry used for requests (default https://registry.npmjs.org). No credential needed.

Run via npx: add a server entry to your Claude Desktop or VS Code/Cursor MCP config with command npx -y @nekzus/mcp-server@latest. Also available via Docker, by mounting createMcpHttpHandler from @nekzus/mcp-server/http on Cloudflare Workers, Hono, Express, or similar platforms, or via the Smithery.ai hosted URL. Configure the registry with the NPM_REGISTRY_URL environment variable.

claude_desktop_config.json

{"mcpServers":{"npm-sentinel":{"command":"npx","args":["-y","@nekzus/mcp-server@latest"]}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json

{
  "servers": {
    "npm-sentinel": {
      "command": "npx",
      "args": [
        "-y",
        "@nekzus/mcp-server@latest"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal

claude mcp add npm-sentinel -- npx -y @nekzus/mcp-server@latest

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After adding the server in your client, check that tools like npmLatest, npmVersions, and npmSearch appear in the tool list, then run npmLatest on a common package such as react to confirm the connection works.

Troubleshooting

Verify the npx command runs directly in a terminal and Node is installed
Check the NPM_REGISTRY_URL environment variable configuration
Use ignoreCache: true to force fresh lookups when cached data appears stale
Cache should auto-invalidate on lockfile changes; otherwise bypass manually
For STDIO connection failures, verify client config JSON syntax

Things to try

Once connected, you can ask your AI assistant things like:

Get the latest version, release dates, and dist-tags for react (npmLatest)
Scan express's dependency tree and list known vulnerabilities in transitive dependencies (npmDeps, npmVulnerabilities)
Compare download trends, bundle size, and quality scores for lodash and ramda (npmCompare)
Search the NPM registry for packages matching rate limit and show the top results (npmSearch)

Tools 19

npmLatest read-only

Get latest version info, release dates, SRI integrity hashes, and dist-tags.

npmVersions read-only

Get full version history with release dates and deprecation statuses.

npmDeps read-only

Complete dependency tree and transitive graph analysis via deps.dev.

npmTypes read-only

Check TypeScript support (native declarations vs @types packages).

npmSize read-only

Analyze bundle size, minified size, and gzip impact.

npmVulnerabilities read-only

Transitive vulnerability scanning via deps.dev and OSV.dev.

npmTrends read-only

Historical download stats over week/month/year ranges.

npmCompare read-only

Side-by-side metric comparison across multiple packages.

Show 11 more tools

npmMaintainers read-only

List maintainers, public emails, and publishing activity.

npmScore read-only

Consolidated quality, popularity, maintenance, and OpenSSF Scorecard score.

npmPackageReadme read-only

Retrieve full raw README markdown from the NPM registry.

npmSearch read-only

Search NPM packages by query with rich metadata.

npmLicenseCompatibility read-only

Analyze license compatibility across multiple packages.

npmRepoStats read-only

GitHub repository stats combined with OpenSSF Scorecard checks.

npmDeprecated read-only

Detect deprecation status on packages and recursive sub-dependencies.

npmChangelogAnalysis read-only

Extract release notes and GitHub release history.

npmAlternatives read-only

Suggest functional alternatives while filtering ecosystem plugins.

npmQuality read-only

Package code quality score (0–1).

npmMaintenance read-only

Package maintenance activity score (0–1).

Use cases

Assessing NPM package security and vulnerabilities before adoption

Analyzing dependency trees and transitive dependencies

Comparing candidate packages on quality and maintenance

Tracking download trends and bundle sizes

Finding functional alternatives to existing packages

Supported clients

Claude Desktop

VS Code

Cursor

Listed from the project's documentation, not tested by this site.

Overview

NPM Sentinel MCP is a Model Context Protocol server offering 19 tools for recursive security scanning, dependency tree analysis, download trends, quality scoring, and alternative suggestions. It leverages Google deps.dev, OSV.dev, OpenSSF Scorecard, and npms.io data, supports both STDIO and Streamable HTTP transports, and includes defenses against indirect prompt injection (OWASP LLM01) plus automatic cache invalidation on lockfile changes.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →

MartinLoop MCP Server 79 · B

An independent control layer that gives AI coding agents budgets, brakes, and receipts

★ 413 Compare with this →

GitHub MCP Server 76 · B

GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language

★ 33.7k · Tools 15 Compare with this →

FastMCP 75 · B

A TypeScript framework for building MCP servers

★ 3.3k Compare with this →

Compare with other MCP servers

Source revision 98964a12ed97 Data synced 2026-10-19 Read the FMRS scoring method