NPMScan
connectsnpmscan.com
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
https://npmscan.com/api/mcpNo authMCP 2025-11-25v3.1.3last checked 18 Oct 2026spoke MCP on 100% of 84 checks (30 days)initialize in 60 msWill my client connect?
Decided from what the probe found at the endpoint, and from what each client's own documentation says it can complete. Every row carries the day that documentation was read.
✓Claude CodeConnects
The endpoint answers an anonymous handshake, so no credential is needed.
claude mcp add --transport http npmscan https://npmscan.com/api/mcpClaude Code docs · read on 2026-08-30
✓Claude (claude.ai & Desktop)Connects
The endpoint answers an anonymous handshake, so no credential is needed.
Settings → Connectors → Add custom connector, then paste https://npmscan.com/api/mcp.
Claude (claude.ai & Desktop) docs · read on 2026-08-30
✓ChatGPTConnects
The endpoint answers an anonymous handshake, so no credential is needed.
Settings → Apps → Advanced settings → Developer mode, then create a connector pointing at https://npmscan.com/api/mcp.
ChatGPT docs · read on 2026-08-30
✓CursorConnects
The endpoint answers an anonymous handshake, so no credential is needed.
{
"mcpServers": {
"npmscan": {
"url": "https://npmscan.com/api/mcp"
}
}
}Cursor docs · read on 2026-08-30
✓VS Code (Copilot)Connects
The endpoint answers an anonymous handshake, so no credential is needed.
{
"servers": {
"npmscan": {
"type": "http",
"url": "https://npmscan.com/api/mcp"
}
}
}VS Code (Copilot) docs · read on 2026-08-30
How to authenticate
Checked against the endpoint by our probe on 18 Oct 2026. These are the capabilities the server advertises, not a prediction about any particular client.
| Scheme | No auth |
|---|---|
| Protected-resource metadata | ✕Not found Without it a client has to guess where the authorization server lives. |
| Anonymous access | Handshake succeeds; 23 tools listable |
Tools
Contract history
Instructions rewritten: diff_dependencies. The description an agent follows changed; the callable contract may not have.
Breaking: diff_dependencies, query_vulnerabilities, simulate_dependency_upgrade
Instructions rewritten: analyze_transitive_dependencies, audit_github_repository, batch_query_vulnerabilities, check_maintainer_changes, compare_packages, diff_dependencies, enrich_npm_audit, prioritize_remediation, simulate_dependency_upgrade. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: diff_dependencies. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: compare_packages. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: batch_query_vulnerabilities, get_latest_advisories, prioritize_remediation. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: check_maintainer_blast_radius, check_maintainer_changes, get_latest_advisories, get_maintainer_profile. The description an agent follows changed; the callable contract may not have.
Breaking: enrich_npm_audit
Instructions rewritten: batch_query_vulnerabilities, enrich_npm_audit. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: get_cve, suggest_alternative. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: compare_packages, get_package, get_package_version, suggest_alternative. The description an agent follows changed; the callable contract may not have.
Breaking: analyze_transitive_dependencies, prioritize_remediation
Instructions rewritten: analyze_transitive_dependencies, audit_github_repository, batch_query_vulnerabilities, diff_dependencies, generate_sbom, prioritize_remediation, query_vulnerabilities. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: batch_query_vulnerabilities, diff_dependencies. The description an agent follows changed; the callable contract may not have.
Breaking: get_latest_advisories
Instructions rewritten: get_latest_advisories. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: check_maintainer_blast_radius, get_maintainer_profile. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: batch_query_vulnerabilities, get_latest_advisories, query_vulnerabilities. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: check_maintainer_changes. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: check_maintainer_blast_radius, get_maintainer_profile. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: check_maintainer_blast_radius. The description an agent follows changed; the callable contract may not have.
Breaking: simulate_dependency_upgrade
Instructions rewritten: audit_github_repository, simulate_dependency_upgrade. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: audit_github_repository, compare_packages. The description an agent follows changed; the callable contract may not have.
Instructions rewritten: check_maintainer_changes. The description an agent follows changed; the callable contract may not have.
Watch this server
Save its public contract as a baseline and manage breaking-change email alerts.
Set up a watchOwn this server?
Sign in to claim this listing by proving control of its host.
Status badge
Status for a README, from the last probe — cached an hour, so up to seven hours behind the endpoint. Links back to this page.
[](https://mcpi.app/servers/npmscan)