ScriptProbe MCP

Lets an assistant inspect an npm package's install-time scripts and publisher changes before you run npm install.

What it does

ScriptProbe exposes one tool, check_package_scripts(name, version?), which reports the install-time scripts an npm package runs, whether each script reaches the network or spawns a process, and whether the account that published the latest version differs from the previous ten. It is meant to be run before installing a package you have not used. A high verdict means the script is worth reading, not that the package is malware; for example, esbuild reads high because its postinstall downloads a platform binary.

When to use it

Use it when you are about to install an unfamiliar npm package and want a quick look at what its install scripts do and whether the publisher recently changed. It is a pre-install check, not a general vulnerability scanner.

Requirements

Runs locally as a stdio process, typically via npx scriptprobe-mcp; Node.js and network access are needed. No API key, signup, environment variables, or headers are required. It can also serve streamable HTTP on a local port.