mcp server
NPMScan
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Description as published by the maintainer. Source
- version 1.0.0
- active
- retrieval
active — Registry entry last updated 2026-08-01. Dashed tags are derived by ZBS Index from the published description, not stated by the maintainer.
What this server can do
6 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.
batch_query_vulnerabilities(packages)- Query OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call. Required: packages.
get_latest_advisories(cveId, cursor, ghsaId, affects, category, severity, direction)- Browse recently published, reviewed GitHub Security Advisories for the npm ecosystem. Filter by severity, vulnerability category (XSS, SQL/NoSQL Injection, SSRF, Access Control, Code Injection, etc.), an affected package name, or look up one exact advisory by GHSA or CVE ID. Paginated with an opaque cursor: pass a previous response's nextCursor back in as cursor to fetch the next page.
get_package(name)- Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page. Required: name.
get_package_version(name, version)- Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release. Required: name, version.
query_vulnerabilities(name, version, ecosystem)- Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package. Required: name.
search_packages(limit, query)- Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page. Required: query.
Last successful function declaration observed on . Source: https://npmscan.com/api/mcp. We list what the server declared; we do not call any of these functions.
Endpoint status observed on . Source: https://npmscan.com/api/mcp.
Signals
These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.
| Signal | Value | What it measures | Window | Observed | Source |
|---|---|---|---|---|---|
| Latest published version | 1.0.0 | Latest version string the maintainer published to the registry. | as of fetch | Model Context Protocol | |
| Registry record last updated | 2026-08-01 | When the registry record was last updated by its maintainer. | point in time | Model Context Protocol | |
| First listed in the MCP Registry | 2026-08-01 | Date this server was first published to the official MCP Registry. Not a usage or quality measure. | point in time | Model Context Protocol | |
| mcp tools declared | 6 tools | Number of functions the server itself declared when asked to list them. This is what the server offers an agent, not a measure of how well any of them work. | as of probe | npmscan.com | |
| mcp endpoint status | ok | The server listed 6 functions when asked. | as of probe | npmscan.com |
Where to get it
This record as data
Every field on this page, with its source and observation date, is in the catalog JSON. Fetch the whole kind at once instead of parsing this HTML.
GET /api/v1/entries/mcp_server.json