MCP Tools Reference

search_packages({ "query": "react-router", "limit": 3 })

{
  "query": "react-router",
  "total": 41,
  "results": [
    {
      "name": "react-router",
      "version": "6.23.1",
      "description": "Declarative routing for React",
      "publisher": "mjackson",
      "weeklyDownloads": 11482031,
      "monthlyDownloads": 48920104,
      "dependentsCount": 8213,
      "topPackagesRank": 87,
      "popularityTier": "very-high",
      "maintenanceTier": "active",
      "possibleTyposquatOf": null,
      "npmscanUrl": "https://npmscan.com/package/react-router"
    }
    /* ...2 more results */
  ]
}

search_packages({ "query": "raect" })

{
  "query": "raect",
  "total": 1,
  "results": [
    {
      "name": "raect",
      "version": "0.0.1",
      "weeklyDownloads": 4,
      "dependentsCount": 0,
      "topPackagesRank": null,
      "popularityTier": "very-low",
      "maintenanceTier": "stale",
      "possibleTyposquatOf": { "name": "react", "rank": 3 },
      "npmscanUrl": "https://npmscan.com/package/raect"
    }
  ]
}

search_packages({ "query": "a" })

{ "error": "\"query\" must be at least 2 characters" }

get_package({ "name": "axios" })

{
  "name": "axios",
  "latestVersion": "1.7.4",
  "latestVersionInfo": {
    "version": "1.7.4",
    "scripts": { "postinstall": "" },
    "deprecated": null
  },
  "weeklyDownloads": 58210442,
  "githubStars": 105300,
  "hasBuiltInTypes": true,
  "daysSinceLastPublish": 12,
  "popularityTier": "very-high",
  "maintenanceTier": "active",
  "maintenanceSummary": "Actively maintained: published 12 days ago, 58.2M weekly downloads, 105.3k GitHub stars.",
  "downloadTrend": { "direction": "stable", "changePercent": 1.4 },
  "possibleTyposquatOf": null,
  "isLatestVersionVulnerable": false,
  "highestSeverity": null,
  "vulnerabilities": []
}

get_package({ "name": "request" })

{
  "name": "request",
  "latestVersion": "2.88.2",
  "latestVersionInfo": {
    "version": "2.88.2",
    "deprecated": "request has been deprecated, see https://github.com/request/request/issues/3142"
  },
  "weeklyDownloads": 9800213,
  "daysSinceLastPublish": 1730,
  "popularityTier": "very-high",
  "maintenanceTier": "stale",
  "maintenanceSummary": "Deprecated by its maintainers; no publish in 1730 days despite still-high download counts from legacy installs.",
  "isLatestVersionVulnerable": false,
  "vulnerabilities": []
}

get_package({ "name": "this-package-does-not-exist-anywhere" })

{ "error": "Package \"this-package-does-not-exist-anywhere\" not found" }

get_package_version({ "name": "minimist", "version": "1.2.5" })

{
  "name": "minimist",
  "version": "1.2.5",
  "isVulnerable": true,
  "highestSeverity": "CRITICAL",
  "vulnerabilities": [
    {
      "id": "GHSA-xvch-5gv4-984h",
      "summary": "Prototype Pollution in minimist",
      "severity": "CRITICAL",
      "aliases": ["CVE-2021-44906"],
      "fixedVersion": "1.2.6",
      "npmscanUrl": "https://npmscan.com/vulnerability/GHSA-xvch-5gv4-984h"
    }
  ]
}

get_package_version({ "name": "minimist", "version": "1.2.6" })

{
  "name": "minimist",
  "version": "1.2.6",
  "isVulnerable": false,
  "highestSeverity": null,
  "vulnerabilities": []
}

get_package_version({ "name": "minimist", "version": "999.0.0" })

{ "error": "Version \"999.0.0\" of package \"minimist\" not found" }

query_vulnerabilities({ "name": "minimist", "version": "1.2.5" })

{
  "package": "minimist",
  "version": "1.2.5",
  "isVulnerable": true,
  "highestSeverity": "CRITICAL",
  "vulnerabilities": [
    { "id": "GHSA-xvch-5gv4-984h", "severity": "CRITICAL", "aliases": ["CVE-2021-44906"], "fixedVersion": "1.2.6", "npmscanUrl": "https://npmscan.com/vulnerability/GHSA-xvch-5gv4-984h" }
  ]
}

query_vulnerabilities({ "name": "minimist", "version": "1.2.6" })

{
  "package": "minimist",
  "version": "1.2.6",
  "isVulnerable": false,
  "highestSeverity": null,
  "vulnerabilities": []
}

query_vulnerabilities({ "name": "minimist" })

{
  "package": "minimist",
  "version": null,
  "isVulnerable": true,
  "highestSeverity": "CRITICAL",
  "vulnerabilities": [
    { "id": "GHSA-xvch-5gv4-984h", "aliases": ["CVE-2021-44906"], "fixedVersion": "1.2.6" },
    { "id": "GHSA-vh95-rmgr-6w4m", "aliases": ["CVE-2020-7598"], "fixedVersion": "1.2.3" }
  ]
}

batch_query_vulnerabilities({
  "packages": [
    { "name": "minimist", "version": "1.2.5" },
    { "name": "is-number", "version": "7.0.0" }
  ]
})

{
  "parsedPackageCount": 2,
  "results": [
    {
      "package": { "name": "minimist", "version": "1.2.5" },
      "vulnerabilityCount": 1,
      "vulnerabilities": [
        { "id": "GHSA-xvch-5gv4-984h", "severity": "CRITICAL", "aliases": ["CVE-2021-44906"], "fixedVersion": "1.2.6" }
      ]
    },
    { "package": { "name": "is-number", "version": "7.0.0" }, "vulnerabilityCount": 0, "vulnerabilities": [] }
  ],
  "totalVulnerabilities": 1,
  "packagesWithVulnerabilities": 1
}

batch_query_vulnerabilities({
  "packages": [
    { "name": "is-number", "version": "7.0.0" },
    { "name": "lodash", "version": "4.17.21" }
  ]
})

{
  "parsedPackageCount": 2,
  "results": [
    { "package": { "name": "is-number", "version": "7.0.0" }, "vulnerabilityCount": 0, "vulnerabilities": [] },
    { "package": { "name": "lodash", "version": "4.17.21" }, "vulnerabilityCount": 0, "vulnerabilities": [] }
  ],
  "totalVulnerabilities": 0,
  "packagesWithVulnerabilities": 0
}

batch_query_vulnerabilities({
  "packages": [{ "name": "lodash" }],
  "content": "{ \"dependencies\": { \"lodash\": \"4.17.21\" } }"
})

{ "error": "Provide either packages or content, not both" }

get_latest_advisories({ "category": "xss", "severity": "high" })

{
  "severity": "high",
  "category": "xss",
  "direction": "desc",
  "nextCursor": "MjAyNS0..._eyJpZCI6MTIzfQ",
  "advisories": [
    {
      "id": "GHSA-xxxx-xxxx-xxxx",
      "cve": "CVE-2025-xxxxx",
      "summary": "Cross-site scripting (XSS) in a Markdown-to-HTML renderer via unsanitized image alt text",
      "severity": "high",
      "categories": ["xss"],
      "packages": [{ "name": "example-markdown-renderer", "affectedRange": "< 3.2.1", "patchedVersion": "3.2.1" }]
    }
    /* ...29 more, per_page is 30 */
  ]
}

get_latest_advisories({ "ghsaId": "GHSA-xvch-5gv4-984h" })

{
  "advisories": [
    { "id": "GHSA-xvch-5gv4-984h", "cve": "CVE-2021-44906", "summary": "Prototype Pollution in minimist", "severity": "critical" }
  ]
}

get_latest_advisories({ "direction": "asc" })

{ "direction": "asc", "advisories": [ /* oldest reviewed advisory first */ ] }

get_cve({ "cveId": "CVE-2021-44228" })

{
  "id": "CVE-2021-44228",
  "vulnStatus": "Analyzed",
  "cvss": { "version": "3.1", "baseScore": 10, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" },
  "cwes": ["Improper Neutralization of Special Elements used in an Expression Language Statement"],
  "source": "nvd",
  "kev": {
    "dateAdded": "2021-12-10",
    "dueDate": "2021-12-24",
    "requiredAction": "Apply updates per vendor instructions."
  },
  "epss": { "score": 0.94421, "percentile": 0.99976, "date": "2026-08-30" }
}

get_cve({ "cveId": "CVE-2099-99999" })

{ "cveId": "CVE-2099-99999", "found": false, "npmscanUrl": "https://npmscan.com/vulnerability/CVE-2099-99999" }

get_cve({})

{ "error": "Provide cveId for an exact lookup, or at least one of keywordSearch/severity/cweId/publishedSince+publishedUntil to search" }

analyze_install_script({ "name": "example-malicious-pkg" })

{
  "name": "example-malicious-pkg",
  "hasLifecycleScripts": true,
  "lifecycleScripts": { "postinstall": "node scripts/setup.js" },
  "findings": [
    { "rule": "child-process", "points": 15, "note": "Spawns a child process during install" },
    { "rule": "network-call", "points": 15, "note": "Makes a network request during install" },
    { "rule": "sensitive-path", "points": 20, "note": "Reads ~/.ssh or ~/.aws during install" },
    { "rule": "remote-binary", "points": 20, "note": "Downloads an executable from an untrusted host" },
    { "rule": "eval-decoded", "points": 25, "note": "Evaluates decoded (base64) content" },
    { "rule": "exfil-endpoint", "points": 20, "note": "Sends data to a Discord webhook" }
  ],
  "totalScore": 115,
  "riskTier": "critical"
}

analyze_install_script({ "name": "lodash" })

{
  "name": "lodash",
  "version": "4.17.21",
  "hasLifecycleScripts": false,
  "lifecycleScripts": {},
  "findings": [],
  "totalScore": 0,
  "riskTier": "none"
}

analyze_install_script({ "name": "cypress" })

{
  "name": "cypress",
  "hasLifecycleScripts": true,
  "lifecycleScripts": { "postinstall": "node index.js --exec install" },
  "findings": [
    { "rule": "lifecycle-present", "points": 5, "note": "Package defines install-time lifecycle scripts" },
    { "rule": "network-call", "points": 15, "note": "Downloads a platform binary from a CDN during install" }
  ],
  "totalScore": 20,
  "riskTier": "low"
}

analyze_transitive_dependencies({
  "packages": [{ "name": "optimist", "version": "0.6.1" }],
  "maxDepth": 2
})

{
  "summary": "Scanned 3 packages across 2 root(s); 1 vulnerable package found, pulled in by optimist.",
  "vulnerablePaths": [
    {
      "name": "minimist",
      "version": "1.2.5",
      "highestSeverity": "CRITICAL",
      "vulnerabilityCount": 1,
      "pulledInBy": ["optimist"]
    }
  ],
  "totalPackagesScanned": 3,
  "vulnerablePackageCount": 1,
  "truncated": false
}

analyze_transitive_dependencies({
  "packages": [{ "name": "express" }, { "name": "body-parser" }]
})

{
  "summary": "Scanned 14 packages across 2 root(s); 0 vulnerable packages found.",
  "vulnerablePaths": [],
  "totalPackagesScanned": 14,
  "vulnerablePackageCount": 0,
  "truncated": false
}

analyze_transitive_dependencies({ "packages": [{ "name": "some-fork", "version": "git+https://github.com/user/some-fork.git" }] })

{
  "nodes": [
    { "name": "some-fork", "version": null, "resolutionError": "Non-registry specifier (git URL) cannot be resolved", "isVulnerable": false }
  ],
  "unresolvedCount": 1
}

check_package_provenance({ "name": "semver", "version": "7.6.3" })

{
  "name": "semver",
  "version": "7.6.3",
  "provenance": {
    "hasProvenance": true,
    "sourceRepository": "https://github.com/npm/node-semver",
    "declaredRepository": "https://github.com/npm/node-semver",
    "repositoryMatchesBuild": true
  },
  "sourceDiff": { "checked": true, "addedInstallScripts": [], "addedDependencies": [] },
  "findings": [],
  "totalScore": 0,
  "riskTier": "none"
}

check_package_provenance({ "name": "@npmcli/arborist" })

{
  "name": "@npmcli/arborist",
  "provenance": { "hasProvenance": false },
  "peers": {
    "orgKind": "scope",
    "orgIdentifier": "@npmcli",
    "peersChecked": 12,
    "peersWithProvenance": 10,
    "peerProvenanceRate": 0.83
  },
  "findings": [
    { "rule": "peer-provenance-anomaly", "points": 15, "note": "83% of packages in the @npmcli scope publish with provenance; this one does not" }
  ],
  "totalScore": 15,
  "riskTier": "low"
}

check_package_provenance({ "name": "lodash" })

{
  "name": "lodash",
  "provenance": { "hasProvenance": false },
  "peers": { "orgKind": "maintainer", "peersChecked": 4, "peersWithProvenance": 0, "peerProvenanceRate": 0 },
  "findings": [],
  "totalScore": 0,
  "riskTier": "none"
}

check_maintainer_changes({ "name": "chalk" })

{
  "name": "chalk",
  "history": {
    "changes": [
      { "version": "5.3.1", "publishedAt": "2025-09-08T15:20:00.000Z", "added": ["qix-"], "removed": [] }
    ]
  },
  "findings": [
    { "rule": "new-maintainer-published-quickly", "points": 35, "note": "A maintainer added shortly before this publish, on a package with years of prior stable history" }
  ],
  "totalScore": 35,
  "riskTier": "high"
}

check_maintainer_changes({ "name": "event-stream" })

{
  "name": "event-stream",
  "history": { "changes": [], "note": "No maintainer changes within the lookback window" },
  "findings": [],
  "totalScore": 0,
  "riskTier": "none"
}

check_maintainer_changes({ "name": "jade" })

{
  "name": "jade",
  "repository": {
    "checked": true,
    "declaredRepository": "https://github.com/jadejs/jade",
    "currentFullName": "pugjs/pug",
    "transferred": true,
    "note": "Repository transferred/renamed; verify the new owner independently before treating this as benign"
  },
  "findings": [
    { "rule": "repository-transferred", "points": 10, "note": "Declared repository now resolves to a different owner/name" }
  ],
  "riskTier": "low"
}

check_license_compliance({
  "packages": [
    { "name": "graphviz" },
    { "name": "lightningcss" },
    { "name": "lodash" }
  ]
})

{
  "policy": { "mode": "default", "allow": [], "deny": [] },
  "summary": "1 of 3 packages violate the default policy (copyleft/network-copyleft/proprietary).",
  "results": [
    { "package": { "name": "graphviz" }, "rawLicense": "GPL-3.0-or-later", "category": "copyleft", "isCompliant": false, "violation": { "rule": "default-copyleft", "text": "GPL-3.0-or-later is copyleft" } },
    { "package": { "name": "lightningcss" }, "rawLicense": "MPL-2.0", "category": "weak-copyleft", "isCompliant": true },
    { "package": { "name": "lodash" }, "rawLicense": "MIT", "category": "permissive", "isCompliant": true }
  ],
  "totalPackages": 3,
  "compliantCount": 2,
  "violationCount": 1
}

check_license_compliance({
  "packages": [{ "name": "expand-template" }],
  "policy": { "deny": ["GPL-3.0"] }
})

{
  "results": [
    { "package": { "name": "expand-template" }, "rawLicense": "(MIT OR WTFPL)", "category": "permissive", "isCompliant": true, "needsReview": false }
  ],
  "violationCount": 0
}

check_license_compliance({
  "packages": [{ "name": "ckeditor4" }],
  "policy": { "allow": ["MIT"] }
})

{
  "results": [
    { "package": { "name": "ckeditor4" }, "rawLicense": "(GPL-2.0-or-later OR LGPL-2.1-or-later OR MPL-1.1)", "category": "mixed", "isCompliant": false, "needsReview": true }
  ],
  "needsReviewCount": 1
}

diff_dependencies({
  "before": "{ \"dependencies\": { \"minimist\": \"1.2.5\" } }",
  "after": "{ \"dependencies\": { \"minimist\": \"1.2.6\" } }"
})

{
  "summary": "1 package changed. 1 vulnerability fixed.",
  "changed": [
    {
      "name": "minimist",
      "beforeVersion": "1.2.5",
      "afterVersion": "1.2.6",
      "changeType": "upgrade",
      "isVulnerable": false,
      "vulnerabilityDelta": "fixed"
    }
  ],
  "flaggedCount": 0
}

diff_dependencies({
  "before": "{ \"dependencies\": { \"minimist\": \"1.2.6\" } }",
  "after": "{ \"dependencies\": { \"minimist\": \"1.2.5\" } }"
})

{
  "summary": "1 package changed. 1 vulnerability introduced by this change.",
  "changed": [
    {
      "name": "minimist",
      "beforeVersion": "1.2.6",
      "afterVersion": "1.2.5",
      "changeType": "downgrade",
      "isVulnerable": true,
      "highestSeverity": "CRITICAL",
      "vulnerabilityDelta": "introduced"
    }
  ],
  "flaggedCount": 1
}

diff_dependencies({
  "before": "{ \"dependencies\": { \"lodash\": \"^4.17.21\" } }",
  "after": "{ \"packages\": { \"node_modules/lodash\": { \"version\": \"4.17.21\" } } }"
})

{
  "beforeFormat": "package.json",
  "afterFormat": "npm-lock",
  "comparisonNote": "before is package.json and after is npm-lock — version strings are compared after resolving both to exact registry versions, not as raw text",
  "changed": [],
  "totalChanged": 0
}

prioritize_remediation({
  "findings": [
    { "packageName": "vulnerable-log4j-wrapper", "cveId": "CVE-2021-44228", "severity": "CRITICAL" },
    { "packageName": "is-number", "severity": "LOW" }
  ]
})

{
  "totalFindings": 2,
  "summary": { "patchNow": 1, "patchSoon": 0, "scheduled": 0, "monitor": 1, "kevListedCount": 1 },
  "ranked": [
    {
      "rank": 1,
      "packageName": "vulnerable-log4j-wrapper",
      "cveId": "CVE-2021-44228",
      "kev": { "dateAdded": "2021-12-10", "requiredAction": "Apply updates per vendor instructions." },
      "epss": { "score": 0.94421, "percentile": 0.99976 },
      "tier": "patch-now",
      "reason": "Confirmed actively exploited (CISA KEV) — patch immediately regardless of EPSS/severity."
    },
    { "rank": 2, "packageName": "is-number", "cveId": null, "kev": null, "tier": "monitor" }
  ]
}

prioritize_remediation({
  "findings": [
    { "packageName": "pkg-a", "cveId": "CVE-2021-44906", "severity": "CRITICAL" },
    { "packageName": "pkg-b", "cveId": "CVE-2021-44906", "severity": "CRITICAL" }
  ]
})

{
  "totalFindings": 2,
  "uniqueCveCount": 1,
  "ranked": [
    { "rank": 1, "packageName": "pkg-a", "cveId": "CVE-2021-44906" },
    { "rank": 2, "packageName": "pkg-b", "cveId": "CVE-2021-44906" }
  ]
}

prioritize_remediation({ "findings": [ /* 201 items */ ] })

{ "error": "findings: Array must contain at most 200 element(s)" }

suggest_alternative({ "name": "node-sass" })

{
  "source": { "name": "node-sass", "deprecated": "node-sass is deprecated. Please use dart-sass instead.", "popularityTier": "high", "maintenanceTier": "stale" },
  "reason": "deprecated",
  "confidence": "high",
  "suggestions": [
    { "name": "sass", "deprecated": null, "isLatestVersionVulnerable": false, "whySuggested": "Named directly in node-sass's own deprecation notice; actively maintained." },
    { "name": "sass-embedded", "deprecated": null, "whySuggested": "Named directly in node-sass's own deprecation notice; faster native binding." }
  ]
}

suggest_alternative({ "name": "request-promise" })

{
  "source": { "name": "request-promise", "deprecated": "request-promise has been deprecated because request has been deprecated." },
  "reason": "deprecated",
  "confidence": "medium",
  "suggestions": [
    { "name": "got", "whySuggested": "Same HTTP-client category, actively maintained, no open vulnerabilities." },
    { "name": "axios", "whySuggested": "Same HTTP-client category, actively maintained, no open vulnerabilities." }
  ]
}

suggest_alternative({ "name": "left-pad" })

{
  "source": { "name": "left-pad" },
  "reason": "general",
  "nonPackageAlternatives": ["String.prototype.padStart()"],
  "suggestions": []
}