# NPMScan

> NPMScan is a threat intelligence platform for the npm ecosystem: package risk analysis, install-script inspection, and a searchable, category-filterable feed of known vulnerabilities and security advisories.

NPMScan also runs a public, read-only **MCP (Model Context Protocol) server** so AI agents can look up npm package
metadata and vulnerabilities directly instead of scraping the site or guessing from a package's README. No API key
required.

## MCP Server (for AI agents)

- [MCP endpoint](https://npmscan.com/api/mcp): Streamable HTTP, JSON-RPC 2.0. Add with `claude mcp add --transport http npmscan https://npmscan.com/api/mcp` or any MCP-compatible client (Claude Code, Claude Desktop, Cursor, ChatGPT Developer Mode).
- [MCP setup guide](https://npmscan.com/docs/mcp): Full instructions, config snippets, and the six available tools (search_packages, get_package, get_package_version, query_vulnerabilities, batch_query_vulnerabilities, get_latest_advisories).

## Docs

- [Docs home](https://npmscan.com/docs)
- [REST API](https://npmscan.com/api)

## Site

- [Search packages](https://npmscan.com/search)
- [Analyze a dependency tree](https://npmscan.com/analyze)
- [Latest vulnerabilities](https://npmscan.com/latest-vulnerabilities): Filterable by severity, 20 vulnerability categories (XSS, SQL/NoSQL Injection, SSRF, Access Control, Code Injection, and more), and searchable by npm package name or an exact GHSA/CVE ID.
- [Latest vulnerabilities RSS](https://npmscan.com/latest-vulnerabilities/rss.xml): Same feed with severity/category `<category>` tags on every item for filtering in a feed reader.