# NPMScan MCP server

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

## Links
- Registry page: https://www.getdrio.com/mcp/io-github-salemalem-npmscan
- Repository: https://github.com/salemalem/npmscan

## Install
- Endpoint: https://npmscan.com/api/mcp
- Auth: Not captured

## Setup notes
- Remote endpoint: https://npmscan.com/api/mcp

## Tools
- search_packages (Search npm packages) - Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page. Endpoint: https://npmscan.com/api/mcp
- get_package (Get npm package details) - Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page. Endpoint: https://npmscan.com/api/mcp
- get_package_version (Get a specific npm package version) - Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release. Endpoint: https://npmscan.com/api/mcp
- query_vulnerabilities (Query known vulnerabilities for a package) - Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package. Endpoint: https://npmscan.com/api/mcp
- batch_query_vulnerabilities (Batch query known vulnerabilities) - Query OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call. Endpoint: https://npmscan.com/api/mcp
- get_latest_advisories (Get latest npm security advisories) - Browse the most recently published, reviewed GitHub Security Advisories for the npm ecosystem, optionally filtered by severity. Endpoint: https://npmscan.com/api/mcp

## Resources
Not captured

## Prompts
Not captured

## Metadata
- Owner: io.github.salemalem
- Version: 1.0.0
- Runtime: Streamable Http
- Transports: HTTP
- License: Not captured
- Language: Not captured
- Stars: Not captured
- Updated: Aug 1, 2026
- Source: https://registry.modelcontextprotocol.io