MCP Server for AI Agents

Add npmscan's package and vulnerability lookups to your AI agent or skill in one line — no API key, no scraping.

Overview

NPMScan runs a remote MCP (Model Context Protocol) server at https://npmscan.com/api/mcp. MCP is an open standard, not Claude-specific — Claude Code, Claude Desktop, ChatGPT (via Developer Mode), Cursor, and other MCP-capable clients can all connect to it. One URL gives your agent six tools for npm package and vulnerability lookups. No API key required; it's the same public, read-only data as the website.

Quick Setup

Claude Code

claude mcp add --transport http npmscan https://npmscan.com/api/mcp

Claude Code project/user config (.mcp.json or ~/.claude.json) and other clients that accept an explicit type

{
  "mcpServers": {
    "npmscan": {
      "type": "http",
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

Stdio-only clients (bridge via mcp-remote) — also the safe fallback for Claude Desktop

{
  "mcpServers": {
    "npmscan": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://npmscan.com/api/mcp"]
    }
  }
}

Claude Desktop: Settings → Connectors → Add custom connector, then paste the URL. ChatGPT: Settings → Connectors → Advanced → Developer Mode (Plus/Pro/Business/Enterprise/Edu only), then Add custom connector.

Available Tools

search_packages
Search npm by name or keywords.
get_package
Latest version, install scripts (preinstall/postinstall), maintainers, license, and recent version history for a package.
get_package_version
Metadata for one exact version — useful for checking a version pinned in a lockfile.
query_vulnerabilities
OSV.dev lookup for known vulnerabilities affecting a package, optionally scoped to a version.
batch_query_vulnerabilities
OSV.dev lookup for up to 100 packages at once — scan a whole package.json in one call.
get_latest_advisories
Latest reviewed GitHub Security Advisories for the npm ecosystem, filterable by severity.

Every tool result includes an npmscanUrlfield linking back to the full write-up on npmscan.com — worth surfacing to whoever's on the other end of the conversation.

Limits & Notes

No authentication — public, read-only data.
Rate-limited to 30 requests/minute per IP on this endpoint.
Stateless Streamable HTTP transport; SSE is disabled (it's deprecated in the current MCP spec).
Upstream data comes from the npm registry, OSV.dev, and GitHub Advisories — subject to their own availability and rate limits.