Npm Mcp

io.github.alisaittekePublished by GitHub account alisaittekev0.0.3Updated Oct 24, 2026

MCP server for npm package management, security analysis, and compatibility checking

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant search npm packages, check their security and quality, compare versions, and validate compatibility before suggesting an install.

What you can do
An unofficial community MCP server for the npm registry. It exposes tools to search packages with ranking and scores, pull details such as versions, dependencies, download stats and deprecation status, run vulnerability checks with safe-version tips, compare versions for breaking changes and semver, and check peer dependency or version conflicts. It also analyzes capabilities (ESM/CJS, TypeScript, platform support, build tools), bundle size, similar packages, and validates npx commands.
When to use it
Useful when an assistant is helping pick, upgrade, or vet JavaScript dependencies and you want registry facts, security and compatibility checks, and alternatives gathered in one place instead of manual lookups. Also handy for sanity-checking an npx command before it is run.
Requirements
Runs locally over stdio, typically launched with npx from the package @alisaitteke/npm-mcp, or installed globally with npm and started as npm-mcp. Needs Node.js and network access to the npm registry. No accounts, API keys, environment variables, or headers are declared.
Before you install
It is unofficial and not affiliated with or endorsed by npm, Inc. It reads public registry data, so queries and package names are sent to the npm registry over the network. Its checks are advisory: vulnerability, quality, and compatibility results should be verified before acting on them, and it does not replace running your own audit or tests.

Installation

In SourceWeft

  1. Open Npm Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[NPM MCP Banner]

NPM MCP

Model Context Protocol server for npm registry

Search packages, check security, compare versions, and validate compatibility. Use it from Cursor AI or Claude Desktop.

Note: This is an unofficial, community-driven MCP server and is not affiliated with or endorsed by npm, Inc.

Features

  • Auto-Security — AI automatically checks packages before suggesting install (no user action!)
  • Capabilities Analysis — ESM/CJS, TypeScript, Platform support (Node/Browser/Deno), Build tools
  • Quick Start Generator — Ready-to-use code examples for any package
  • Package Comparison — Compare alternatives side-by-side (features, size, popularity)
  • Bundle Size Analysis — Minified/gzipped sizes, tree-shaking, impact on your bundle
  • Similar Packages — Find alternatives and similar packages
  • Search — Find packages with ranking and scores
  • Details — Versions, dependencies, download stats, deprecation status
  • Security — Vulnerability check and safe version tips
  • Compatibility — Peer dependency and version conflicts
  • Quality — Maintenance and community metrics
  • Version compare — Breaking changes and semver
  • NPX check — Validate npx commands before running

Install & use

With npx (recommended)

No global install. Add to Cursor or Claude config:

Cursor — ~/.cursor/mcp.json:

json
{  "mcpServers": {    "npm-registry-mcp": {      "command": "npx",      "args": ["@alisaitteke/npm-mcp"]    }  }}

Claude Desktop — ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):

json
{  "mcpServers": {    "npm-registry-mcp": {      "command": "npx",      "args": ["@alisaitteke/npm-mcp"]    }  }}

Global install (optional)

bash
npm install -g @alisaitteke/npm-mcp

Then use "command": "npm-mcp" (no args) in the config above.

What you can ask

Once the server is connected, you can ask things like:

  • “Search for React state management libraries”
  • “Security audit for [email protected]”
  • “Is [email protected] compatible with my current deps?”
  • “Compare React 17 and 18”
  • “Quality check for date-fns”
  • “Is it safe to run npx create-next-app?”

License

MIT

Contributors

[Ali Sait Teke]
Ali Sait Teke
Creator & Maintainer

Thanks to everyone who helps improve this project!

[Contributors]

Source: README.md at commit 0c5624c

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.0.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts