Nekzus Npm Sentinel Mcp

ai.smithery由 smithery.ai 发布官方发布者v1.11.8更新于 Oct 24, 2026

Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…

发布方自己的服务：222wcnm Bilistalkermcp

已验证Streamable HTTP可网页运行开发者工具安全与监控数据与分析

服务详情

标识符: ai.smithery/Nekzus-npm-sentinel-mcp
传输: Streamable HTTP
运行时: Web executable
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此服务的命名空间属于 smithery.ai，且该域名同时运行其端点。这可以确认发布者，但并不代表该服务的工具是安全的。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/ai.smithery%2FNekzus-npm-sentinel-mcp.svg)](https://sourceweft.com/mcp/ai.smithery%2FNekzus-npm-sentinel-mcp?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

让助手实时获取 NPM 软件包情报：版本、依赖、漏洞、体积、质量、许可证与替代方案。

可以做什么: 提供 19 个只读工具用于分析 NPM 软件包。可返回最新版本与完整版本历史、依赖与传递依赖图、TypeScript 支持情况、打包体积、下载趋势、维护者、仓库统计以及综合质量与维护评分。安全扫描基于 Google deps.dev 与 OSV.dev 公告，还支持软件包对比、许可证兼容性检查、弃用检测、读取 README 与变更日志，以及推荐功能替代方案。此外还提供服务器资源和一个软件包分析提示词。
适用场景: 适合助手评估、审计或选择 NPM 依赖时使用：在引入某个包之前检查漏洞、弃用、许可证冲突、打包体积或维护状况，或在代码审查与升级过程中比较替代方案。
运行要求: 可作为远程 streamable HTTP 端点运行，也可通过 npx @nekzus/mcp-server（Node.js）或 Docker 在本地运行。远程端点需要 Smithery 身份验证的 Authorization bearer 令牌。需要访问 NPM registry 及第三方服务（deps.dev、OSV.dev、npms.io、GitHub）的网络；registry 地址可用 NPM_REGISTRY_URL 覆盖。

安装前请注意

远程端点需要 Authorization bearer 令牌，属于需妥善保管的机密。分析查询会发送给第三方，包括 deps.dev、OSV.dev、npms.io 和 GitHub。README 与变更日志内容属于不可信的第三方文本，会被包裹在 untrusted_external_content 标签中；应视为数据而非指令。工具为只读，不会修改软件包或发布任何内容。

安装

在 SourceWeft 中

打开控制台中的 Nekzus Npm Sentinel Mcp，将其添加到工作区。
连接所需的凭据。它们会被私密存储，绝不会在公开页面上展示。
为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/ai.smithery%2FNekzus-npm-sentinel-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。客户端会在首次连接时完成 OAuth 登录。

{
  "mcpServers": {
    "nekzus-npm-sentinel": {
      "type": "http",
      "url": "https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp"
    }
  }
}

README

NPM Sentinel MCP

[smithery badge] [Github Workflow] [npm version] [npm-month] [npm-total] [Docker Hub] [Ask DeepWiki] [Donate]

A powerful Model Context Protocol (MCP v2) server built on @modelcontextprotocol/server and @modelcontextprotocol/core (v2) that revolutionizes NPM package analysis through AI. Built to integrate seamlessly with Claude, Anthropic AI, and any MCP v2 compatible client, it provides real-time intelligence on package security, dependencies, and performance.

This server features Modular ESM Architecture (src/), Dual Output Protocol Returns (content + structuredContent), Zod Output Schemas (outputSchema), Embedded SVG Data URI Icons, and Real-Time Context Logging.

Key Features

MCP v2 Native Protocol: Fully upgraded to MCP v2 with outputSchema Zod validation, dual structuredContent returning, and diagnostic context logging (ctx.mcpReq.log).
Self-Contained Vector Icons: Pre-configured SVG Data URIs (data:image/svg+xml) embedded across all 19 tools, resources, and prompts for enhanced client UI presentation.
Advanced Security Scanning: Recursive dependency checks powered by Google's deps.dev and OSV.dev, ecosystem awareness, and accurate version resolution.
Smart Alternatives Filtering (npmAlternatives): Intelligent search based on functional domain keywords with strict ecosystem plugin/extension filtering (e.g., excludes express-rate-limit when searching for alternatives to express).
Strict Input Validation & Batch Rate Control: Input sanitization via Zod against Path Traversal, SSRF, and Command Injection. Search queries (npmSearch) are capped at 100 characters and filtered for control characters. Batch analysis tools enforce a strict cap of 25 packages per request to prevent registry enumeration DoS.
Dependency & Transitive Mapping: Complete dependency tree analysis mapping through deps.dev.
Package Quality & Maintenance Metrics: Real-time scoring using OpenSSF Scorecard, GitHub repository metrics, and npms.io.
Download Trends & Performance: Real-time download statistics and bundle size analysis.
Smart SemVer Shorthand & Range Resolution: Transparently resolves major version shorthands, prefixes, and ranges (e.g., express@2, express@v4, [email protected], react@^18, lodash@~4.17) to the highest matching release without failing on missing exact version keys.
Indirect Prompt Injection Defense (OWASP LLM01): All tools returning raw 3rd-party Markdown/text (npmPackageReadme, npmChangelogAnalysis) wrap untrusted content in <untrusted_external_content> tags, attach _meta.untrustedExternalContent = true flags, and enforce strict tool schema warnings.
Efficient Caching System: Automated cache invalidation on workspace lockfile changes (pnpm-lock.yaml, package-lock.json, yarn.lock) with manual bypass (ignoreCache: true).

Security & OWASP LLM01 Compliance

This server implements Defense-in-Depth controls aligned with OWASP LLM01:2025 (Indirect Prompt Injection):

XML Data Demarcation: Content from external packages (README.md, GitHub changelogs, release notes) is wrapped inside <untrusted_external_content source="..." package="..." type="..."> tags so consuming LLM models distinguish untrusted data from instructions.
Metadata Signaling (_meta): Responses include _meta.untrustedExternalContent = true and _meta.sources arrays for programmatic client-side detection and policy enforcement.
Tool & Prompt Safety Warnings: Tool descriptions and prompt definitions explicitly instruct LLM agents to treat documentation as passive data and ignore embedded execution commands.
Batch Size Capping & Query Sanitization: All 18 multi-package analysis tools enforce a 25-package limit per request (PackageListSchema). Search queries are sanitized and capped at 100 characters (SearchQuerySchema).
Prototype Pollution Protection: Enforces Object.hasOwn() checks on dictionary lookups (blocking reserved properties like constructor and __proto__).

To ensure data accuracy while maintaining high performance:

Automatic Invalidation: The cache is automatically invalidated whenever pnpm-lock.yaml, package-lock.json, or yarn.lock changes in your workspace.
Force Refresh: All tools accept an optional ignoreCache: true parameter to bypass the cache and force a fresh lookup from the NPM registry.

Example Usage (JSON-RPC)

Installation & Transports

Dual-Era MCP Architecture (v1 `2025-11-25` + v2 `2026-07-28`)

This MCP server features native Dual-Era Protocol Compatibility, seamlessly serving both modern MCP v2 clients (2026-07-28) and legacy MCP v1 clients (2025-11-25) out of the box across both STDIO and Streamable HTTP transports:

STDIO Mode (npx @nekzus/mcp-server): Powered by serveStdio({ legacy: "serve" }). Handles modern server/discover probes sessionlessly and conjoins seamlessly with legacy initialize handshakes for local execution (Claude Desktop, Cursor, Docker).
Streamable HTTP / SSE Mode (@nekzus/mcp-server/http): Powered by createMcpHandler({ legacy: "stateless" }). Designed for serverless and web-standard runtimes (Cloudflare Workers, Hono, Express, Vercel API Routes, Smithery.ai).

Example: Mounting HTTP Handler (Cloudflare Workers / Hono / Express)

typescript

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleRequest = createMcpHttpHandler();
export default {  async fetch(request, env, ctx) {    return handleRequest(request);  }};

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleRequest = createMcpHttpHandler();
export default {  async fetch(request, env, ctx) {    return handleRequest(request);  }};

Development Commands:

bash

# Install dependenciespnpm install
# Compile TypeScript to dist/pnpm run build
# Start STDIO server (Dual-Era)pnpm run start
# Development server with Smithery CLI playgroundpnpm run dev
# Run full unit and integration test suite (238 tests)pnpm test -- --run
# Run full E2E tarball verificationnode __tests__/full-e2e-pack-validation.js

# Install dependenciespnpm install
# Compile TypeScript to dist/pnpm run build
# Start STDIO server (Dual-Era)pnpm run start
# Development server with Smithery CLI playgroundpnpm run dev
# Run full unit and integration test suite (238 tests)pnpm test -- --run
# Run full E2E tarball verificationnode __tests__/full-e2e-pack-validation.js

Install in VS Code / Cursor

Add this to your VS Code / Cursor MCP configuration:

json

{  "inputs": [],  "servers": {    "npm-sentinel": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

{  "inputs": [],  "servers": {    "npm-sentinel": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

Install in Claude Desktop

Add this to your claude_desktop_config.json:

json

{  "mcpServers": {    "npm-sentinel": {      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

{  "mcpServers": {    "npm-sentinel": {      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

Configuration File Locations:

Windows: %APPDATA%\Claude\claude_desktop_config.json
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

Smithery.ai Deployment

json

{  "mcpServers": {    "npm-sentinel": {      "type": "http",      "url": "https://smithery.ai/server/@Nekzus/npm-sentinel-mcp"    }  }}

{  "mcpServers": {    "npm-sentinel": {      "type": "http",      "url": "https://smithery.ai/server/@Nekzus/npm-sentinel-mcp"    }  }}

Docker Usage

bash

# Build Docker imagedocker build -t nekzus/npm-sentinel-mcp .
# Run with local volume mountdocker run -i --rm -w /projects -v ${PWD}:/projects nekzus/npm-sentinel-mcp node dist/index.js

# Build Docker imagedocker build -t nekzus/npm-sentinel-mcp .
# Run with local volume mountdocker run -i --rm -w /projects -v ${PWD}:/projects nekzus/npm-sentinel-mcp node dist/index.js

Web Standard Streamable HTTP & Cloudflare Workers Integration

The package exports createMcpHttpHandler and WebStandardStreamableHTTPServerTransport for serverless platforms (Cloudflare Workers, Hono, Vercel, Express, Fastify, Next.js API routes) requiring official Web Standard Streamable HTTP transport under MCP v2:

typescript

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleMcpRequest = createMcpHttpHandler();
export default {  async fetch(request: Request): Promise<Response> {    return handleMcpRequest(request);  },};

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleMcpRequest = createMcpHttpHandler();
export default {  async fetch(request: Request): Promise<Response> {    return handleMcpRequest(request);  },};

100% MCP v2 Compliance: Powered by WebStandardStreamableHTTPServerTransport, this handler natively activates all 3 MCP primitives (Tools, Resources, and Prompts) with peak performance, SSE streaming support, and full Web Standard Request $\rightarrow$ Response compatibility.

Configuration

The server supports the following configuration parameters:

MCP Server Capabilities (v2 API)

All tool responses conform to the MCP v2 dual output format, providing both human-readable text in content and parsed JSON objects in structuredContent:

json

{  "content": [    {      "type": "text",      "text": "{\n  \"queryPackages\": [\"express\"],\n  \"results\": [...]\n}"    }  ],  "structuredContent": {    "queryPackages": ["express"],    "results": [...]  }}

{  "content": [    {      "type": "text",      "text": "{\n  \"queryPackages\": [\"express\"],\n  \"results\": [...]\n}"    }  ],  "structuredContent": {    "queryPackages": ["express"],    "results": [...]  }}

Server Resources

Accessible via MCP readResource requests:

doc://server/readme
- Description: Main documentation file for NPM Sentinel MCP server.
- MIME Type: text/markdown
- Icon: Embedded Document SVG Data URI.
doc://mcp/specification
- Description: Complete Model Context Protocol specification file (llms-full.txt).
- MIME Type: text/plain
- Icon: Embedded Document SVG Data URI.

Server Prompts

Accessible via MCP getPrompt requests:

analyze-package
- Description: Generates a comprehensive prompt template for AI analysis of an NPM package including security, performance, dependencies, and health metrics.
- Arguments: package (string, required)
- Icon: Embedded Security SVG Data URI.

Tools Catalog (19 Tools)

All 19 tools define inputSchema, outputSchema, annotations (title, readOnlyHint), and icons:

1. `npmLatest`

Get latest version information, release dates, SRI integrity hashes, and dist-tags.
Input: packages (string[]), ignoreCache (boolean, optional)

2. `npmVersions`

Get full version history with release dates and deprecation statuses.
Input: packages (string[]), ignoreCache (boolean, optional)

3. `npmDeps`

Complete dependency tree analysis including direct dependencies and full transitive graph mapping via deps.dev.
Input: packages (string[]), ignoreCache (boolean, optional)

4. `npmTypes`

Verify TypeScript support (native index.d.ts declaration files vs @types/* DefinitelyTyped packages).
Input: packages (string[]), ignoreCache (boolean, optional)

5. `npmSize`

Package bundle size, minified size, and gzip impact analysis.
Input: packages (string[]), ignoreCache (boolean, optional)

6. `npmVulnerabilities`

Instant transitive vulnerability scanning powered by Google's deps.dev and OSV.dev advisories.
Input: packages (string[]), ignoreCache (boolean, optional)

7. `npmTrends`

Historical download statistics over customizable time ranges (last-week, last-month, last-year).
Input: packages (string[]), period ("last-week" | "last-month" | "last-year"), ignoreCache (boolean, optional)

8. `npmCompare`

Side-by-side metric comparison across multiple packages.
Input: packages (string[]), ignoreCache (boolean, optional)

9. `npmMaintainers`

List of package maintainers, public emails, and publishing activity.
Input: packages (string[]), ignoreCache (boolean, optional)

10. `npmScore`

Consolidated score combining quality, popularity, maintenance, and OpenSSF Scorecard.
Input: packages (string[]), ignoreCache (boolean, optional)

11. `npmPackageReadme`

Retrieve full formatted raw README markdown content from NPM registry / CDN.
Input: packages (string[]), ignoreCache (boolean, optional)

12. `npmSearch`

Search NPM registry packages by query with rich metadata (scores, publisher, keywords).
Input: query (string), limit (number, optional)

13. `npmLicenseCompatibility`

Analyze license compatibility across multiple packages (MIT, Apache-2.0, GPL, etc.).
Input: packages (string[]), ignoreCache (boolean, optional)

14. `npmRepoStats`

Repository statistics (GitHub stars, forks, open issues) combined with OpenSSF Scorecard checks.
Input: packages (string[]), ignoreCache (boolean, optional)

15. `npmDeprecated`

Detect deprecation status on package and recursive sub-dependencies.
Input: packages (string[]), ignoreCache (boolean, optional)

16. `npmChangelogAnalysis`

Extract release notes and GitHub release history.
Input: packages (string[]), ignoreCache (boolean, optional)

17. `npmAlternatives`

Smart functional alternative suggestions filtering out ecosystem plugins (e.g. excludes express-rate-limit for express).
Input: packages (string[]), ignoreCache (boolean, optional)

18. `npmQuality`

Package code quality score (0–1).
Input: packages (string[]), ignoreCache (boolean, optional)

19. `npmMaintenance`

Package maintenance activity score (0–1).
Input: packages (string[]), ignoreCache (boolean, optional)

License

This MCP server is licensed under the MIT License. See LICENSE for details.

MIT © nekzus

来源：README.md，提交 98964a1

工具

该服务器需要登录，因此 SourceWeft 无法在没有账号的情况下读取其工具，也未收录。已连接账号所能看到的内容可能因账号及其权限而异。

版本历史

v1.11.8最新Sep 16, 2026

评分

已满足适用检查项的 85%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

近 30 天内可连通必需25 分
已声明认证方式必需10 分
已列出工具15 分
请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。
描述必需15 分
图标10 分
文档15 分
许可证10 分

其他 Smithery 集成

222wcnm Bilistalkermcp

ai.smithery官方发布者

Bilibili 创作者分析服务器，让助手查询指定用户的资料、视频、动态、专栏、字幕、关注列表和评论。

Streamable HTTP可网页运行

知识与记忆尚未收录Oct 24, 2026

Zwldarren Akshare One Mcp

ai.smithery官方发布者

远程 MCP 服务器，让助手以只读方式获取中国股市数据：历史与实时行情、新闻和财务报表。

Streamable HTTP可网页运行鉴权

金融需要凭据Oct 24, 2026

Zhaoganghao Hellomcp

ai.smithery官方发布者

一个小型远程 MCP 服务器，让助手按名字向人问候，并介绍“Hello, World”的由来。

Streamable HTTP可网页运行

尚未收录Oct 24, 2026

Zeta Chain Cli

ai.smithery官方发布者

一个远程 MCP 服务器，让助手为任意姓名或受众生成友好、可定制的问候语。

Streamable HTTP可网页运行鉴权

需要凭据Oct 24, 2026

Yuna0x0 Hackmd Mcp

ai.smithery官方发布者

一个连接 HackMD API 的 MCP 服务器，让助手读取、创建、更新和删除 HackMD 笔记并管理团队。

Streamable HTTP可网页运行

沟通与协作尚未收录Oct 25, 2026

Nekzus Npm Sentinel Mcp

概览

安装

在 SourceWeft 中

交给智能体安装

其他 MCP 客户端

README

NPM Sentinel MCP

Key Features

Security & OWASP LLM01 Compliance

Example Usage (JSON-RPC)

Installation & Transports

Dual-Era MCP Architecture (v1 2025-11-25 + v2 2026-07-28)

Install in VS Code / Cursor

Install in Claude Desktop

Smithery.ai Deployment

Docker Usage

Web Standard Streamable HTTP & Cloudflare Workers Integration

Configuration

MCP Server Capabilities (v2 API)

Server Resources

Server Prompts

Tools Catalog (19 Tools)

1. npmLatest

2. npmVersions

3. npmDeps

4. npmTypes

5. npmSize

6. npmVulnerabilities

7. npmTrends

8. npmCompare

9. npmMaintainers

10. npmScore

11. npmPackageReadme

12. npmSearch

13. npmLicenseCompatibility

14. npmRepoStats

15. npmDeprecated

16. npmChangelogAnalysis

17. npmAlternatives

18. npmQuality

19. npmMaintenance

License

工具

版本历史

评分

其他 Smithery 集成

222wcnm Bilistalkermcp

Zwldarren Akshare One Mcp

Zhaoganghao Hellomcp

Zeta Chain Cli

Yuna0x0 Hackmd Mcp

Dual-Era MCP Architecture (v1 `2025-11-25` + v2 `2026-07-28`)

1. `npmLatest`

2. `npmVersions`

3. `npmDeps`

4. `npmTypes`

5. `npmSize`

6. `npmVulnerabilities`

7. `npmTrends`

8. `npmCompare`

9. `npmMaintainers`

10. `npmScore`

11. `npmPackageReadme`

12. `npmSearch`

13. `npmLicenseCompatibility`

14. `npmRepoStats`

15. `npmDeprecated`

16. `npmChangelogAnalysis`

17. `npmAlternatives`

18. `npmQuality`

19. `npmMaintenance`