Npm Plus

io.github.ofershapPublished by GitHub account ofershapv1.0.1Updated Oct 24, 2026

npm MCP — search packages, bundle sizes, vulnerabilities, compare downloads.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant research npm packages: search, package details, download stats, bundle sizes, vulnerabilities, and dependency trees.

What you can do
Provides tools for npm package research from an AI assistant: search packages by query, get package info such as description, license, repository and dependencies, fetch download counts, compare downloads across packages, get daily download trends, look up bundle size (minified and gzip) via Bundlephobia, retrieve vulnerability information with advisory links, and show direct dependencies as a tree.
When to use it
Useful when choosing between npm packages or auditing one, for example comparing download numbers, bundle sizes and dependency counts side by side, checking whether a package has known vulnerabilities, or inspecting its dependency tree without leaving the editor.
Requirements
Runs locally over stdio, typically started with npx mcp-server-npm-plus, so Node.js and network access to public npm registry APIs and Bundlephobia are needed. No API keys or accounts are required.
Before you install
Read-only research tools; it does not install, modify or publish packages. Queries and package names are sent to public third-party services (npm registry and Bundlephobia), so avoid submitting private or sensitive package names.

Installation

In SourceWeft

  1. Open Npm Plus in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-server-npm-plus

[npm version] [npm downloads] [CI] [TypeScript] [License: MIT]

npm package research from your AI assistant. Search packages, check bundle sizes, scan for vulnerabilities, compare download counts, and inspect dependency trees. No API keys needed.

bash
npx mcp-server-npm-plus

Works with Claude Desktop, Cursor, VS Code Copilot, and any MCP client. Uses public npm registry APIs.

[MCP server for npm package search, bundle size, and vulnerability scanning]

Demo built with remotion-readme-kit

Why

Choosing between npm packages usually means opening a bunch of browser tabs: npm for package info, Bundlephobia for size, Snyk for vulnerabilities, npm trends for download comparisons. This server puts all of that in one place, accessible through your AI assistant. Ask "compare zustand vs jotai vs valtio" and get download numbers, bundle sizes, and dependency counts side by side. Ask "are there any known vulnerabilities in express?" and get the answer without leaving your editor. It uses only public npm APIs, so there's nothing to sign up for.

Tools

ToolDescription
searchSearch npm packages by query
package_infoGet detailed info: description, license, repo, dependencies
downloadsGet download stats for a package
compare_downloadsCompare download counts across multiple packages
bundle_sizeGet bundle size (minified + gzip) via Bundlephobia
vulnerabilitiesGet vulnerability info and advisory links
dependency_treeShow direct dependencies as a tree
download_trendsDaily breakdown with sparkline

Quick Start

Cursor

Add to .cursor/mcp.json:

json
{  "mcpServers": {    "npm-plus": {      "command": "npx",      "args": ["mcp-server-npm-plus"]    }  }}

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "npm-plus": {      "command": "npx",      "args": ["mcp-server-npm-plus"]    }  }}

VS Code

Use the MCP extension and configure the server with npx mcp-server-npm-plus.

Example Prompts

  • "Search npm for React state management libraries"
  • "What's the bundle size of lodash?"
  • "Compare downloads of zustand vs jotai vs valtio"
  • "Check for vulnerabilities in express"
  • "Show me the dependency tree for next"
  • "What are the download trends for typescript this month?"

Development

bash
npm installnpm run typechecknpm run buildnpm testnpm run lintnpm run format

See also

More MCP servers and developer tools on my portfolio.

Author

[Made by ofershap]

[LinkedIn] [GitHub]

README built with README Builder

License

MIT © 2026 Ofer Shapira

Source: README.md at commit 4c7edf8

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts