Nekzus Npm Sentinel Mcp

ai.smithery由 smithery.ai 發布官方發布者v1.11.8更新於 Oct 24, 2026

Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…

發布方自己的服務：222wcnm Bilistalkermcp

已驗證Streamable HTTP可網頁執行開發者工具安全與監控資料與分析

服務詳細資訊

識別碼: ai.smithery/Nekzus-npm-sentinel-mcp
傳輸: Streamable HTTP
執行環境: Web executable
信任: Verified
發布於: Sep 16, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此服務的命名空間屬於 smithery.ai，且該網域同時執行其端點。這可以確認發布者，但並不代表該服務的工具是安全的。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/ai.smithery%2FNekzus-npm-sentinel-mcp.svg)](https://sourceweft.com/mcp/ai.smithery%2FNekzus-npm-sentinel-mcp?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

讓助理即時取得 NPM 套件情報：版本、相依性、弱點、體積、品質、授權與替代方案。

可以做什麼: 提供 19 個唯讀工具來分析 NPM 套件。可回傳最新版本與完整版本歷程、相依性與遞移相依圖、TypeScript 支援情形、打包體積、下載趨勢、維護者、儲存庫統計，以及綜合品質與維護評分。安全掃描採用 Google deps.dev 與 OSV.dev 公告，也支援套件比較、授權相容性檢查、棄用偵測、讀取 README 與變更記錄，並推薦功能替代方案。另外還提供伺服器資源與一個套件分析提示詞。
適用情境: 適合助理評估、稽核或挑選 NPM 相依套件時使用：在加入某個套件前檢查弱點、棄用、授權衝突、打包體積或維護狀況，或在程式碼審查與升級過程中比較替代方案。
執行需求: 可作為遠端 streamable HTTP 端點執行，也可透過 npx @nekzus/mcp-server（Node.js）或 Docker 在本機執行。遠端端點需要 Smithery 驗證用的 Authorization bearer 權杖。需要能連線至 NPM registry 及第三方服務（deps.dev、OSV.dev、npms.io、GitHub）；registry 位址可用 NPM_REGISTRY_URL 覆寫。

安裝前請注意

遠端端點需要 Authorization bearer 權杖，屬於必須妥善保管的機密。分析查詢會傳送給第三方，包括 deps.dev、OSV.dev、npms.io 與 GitHub。README 與變更記錄內容屬於不可信的第三方文字，會被包在 untrusted_external_content 標籤中；應視為資料而非指令。工具為唯讀，不會修改套件或發布任何內容。

安裝

在 SourceWeft 中

開啟儀表板中的 Nekzus Npm Sentinel Mcp，將其新增到工作區。
連接所需的憑證。它們會被私密儲存，絕不會在公開頁面上展示。
為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/ai.smithery%2FNekzus-npm-sentinel-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "nekzus-npm-sentinel": {
      "type": "http",
      "url": "https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp"
    }
  }
}

README

NPM Sentinel MCP

[smithery badge] [Github Workflow] [npm version] [npm-month] [npm-total] [Docker Hub] [Ask DeepWiki] [Donate]

A powerful Model Context Protocol (MCP v2) server built on @modelcontextprotocol/server and @modelcontextprotocol/core (v2) that revolutionizes NPM package analysis through AI. Built to integrate seamlessly with Claude, Anthropic AI, and any MCP v2 compatible client, it provides real-time intelligence on package security, dependencies, and performance.

This server features Modular ESM Architecture (src/), Dual Output Protocol Returns (content + structuredContent), Zod Output Schemas (outputSchema), Embedded SVG Data URI Icons, and Real-Time Context Logging.

Key Features

MCP v2 Native Protocol: Fully upgraded to MCP v2 with outputSchema Zod validation, dual structuredContent returning, and diagnostic context logging (ctx.mcpReq.log).
Self-Contained Vector Icons: Pre-configured SVG Data URIs (data:image/svg+xml) embedded across all 19 tools, resources, and prompts for enhanced client UI presentation.
Advanced Security Scanning: Recursive dependency checks powered by Google's deps.dev and OSV.dev, ecosystem awareness, and accurate version resolution.
Smart Alternatives Filtering (npmAlternatives): Intelligent search based on functional domain keywords with strict ecosystem plugin/extension filtering (e.g., excludes express-rate-limit when searching for alternatives to express).
Strict Input Validation & Batch Rate Control: Input sanitization via Zod against Path Traversal, SSRF, and Command Injection. Search queries (npmSearch) are capped at 100 characters and filtered for control characters. Batch analysis tools enforce a strict cap of 25 packages per request to prevent registry enumeration DoS.
Dependency & Transitive Mapping: Complete dependency tree analysis mapping through deps.dev.
Package Quality & Maintenance Metrics: Real-time scoring using OpenSSF Scorecard, GitHub repository metrics, and npms.io.
Download Trends & Performance: Real-time download statistics and bundle size analysis.
Smart SemVer Shorthand & Range Resolution: Transparently resolves major version shorthands, prefixes, and ranges (e.g., express@2, express@v4, [email protected], react@^18, lodash@~4.17) to the highest matching release without failing on missing exact version keys.
Indirect Prompt Injection Defense (OWASP LLM01): All tools returning raw 3rd-party Markdown/text (npmPackageReadme, npmChangelogAnalysis) wrap untrusted content in <untrusted_external_content> tags, attach _meta.untrustedExternalContent = true flags, and enforce strict tool schema warnings.
Efficient Caching System: Automated cache invalidation on workspace lockfile changes (pnpm-lock.yaml, package-lock.json, yarn.lock) with manual bypass (ignoreCache: true).

Security & OWASP LLM01 Compliance

This server implements Defense-in-Depth controls aligned with OWASP LLM01:2025 (Indirect Prompt Injection):

XML Data Demarcation: Content from external packages (README.md, GitHub changelogs, release notes) is wrapped inside <untrusted_external_content source="..." package="..." type="..."> tags so consuming LLM models distinguish untrusted data from instructions.
Metadata Signaling (_meta): Responses include _meta.untrustedExternalContent = true and _meta.sources arrays for programmatic client-side detection and policy enforcement.
Tool & Prompt Safety Warnings: Tool descriptions and prompt definitions explicitly instruct LLM agents to treat documentation as passive data and ignore embedded execution commands.
Batch Size Capping & Query Sanitization: All 18 multi-package analysis tools enforce a 25-package limit per request (PackageListSchema). Search queries are sanitized and capped at 100 characters (SearchQuerySchema).
Prototype Pollution Protection: Enforces Object.hasOwn() checks on dictionary lookups (blocking reserved properties like constructor and __proto__).

To ensure data accuracy while maintaining high performance:

Automatic Invalidation: The cache is automatically invalidated whenever pnpm-lock.yaml, package-lock.json, or yarn.lock changes in your workspace.
Force Refresh: All tools accept an optional ignoreCache: true parameter to bypass the cache and force a fresh lookup from the NPM registry.

Example Usage (JSON-RPC)

Installation & Transports

Dual-Era MCP Architecture (v1 `2025-11-25` + v2 `2026-07-28`)

This MCP server features native Dual-Era Protocol Compatibility, seamlessly serving both modern MCP v2 clients (2026-07-28) and legacy MCP v1 clients (2025-11-25) out of the box across both STDIO and Streamable HTTP transports:

STDIO Mode (npx @nekzus/mcp-server): Powered by serveStdio({ legacy: "serve" }). Handles modern server/discover probes sessionlessly and conjoins seamlessly with legacy initialize handshakes for local execution (Claude Desktop, Cursor, Docker).
Streamable HTTP / SSE Mode (@nekzus/mcp-server/http): Powered by createMcpHandler({ legacy: "stateless" }). Designed for serverless and web-standard runtimes (Cloudflare Workers, Hono, Express, Vercel API Routes, Smithery.ai).

Example: Mounting HTTP Handler (Cloudflare Workers / Hono / Express)

typescript

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleRequest = createMcpHttpHandler();
export default {  async fetch(request, env, ctx) {    return handleRequest(request);  }};

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleRequest = createMcpHttpHandler();
export default {  async fetch(request, env, ctx) {    return handleRequest(request);  }};

Development Commands:

bash

# Install dependenciespnpm install
# Compile TypeScript to dist/pnpm run build
# Start STDIO server (Dual-Era)pnpm run start
# Development server with Smithery CLI playgroundpnpm run dev
# Run full unit and integration test suite (238 tests)pnpm test -- --run
# Run full E2E tarball verificationnode __tests__/full-e2e-pack-validation.js

# Install dependenciespnpm install
# Compile TypeScript to dist/pnpm run build
# Start STDIO server (Dual-Era)pnpm run start
# Development server with Smithery CLI playgroundpnpm run dev
# Run full unit and integration test suite (238 tests)pnpm test -- --run
# Run full E2E tarball verificationnode __tests__/full-e2e-pack-validation.js

Install in VS Code / Cursor

Add this to your VS Code / Cursor MCP configuration:

json

{  "inputs": [],  "servers": {    "npm-sentinel": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

{  "inputs": [],  "servers": {    "npm-sentinel": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

Install in Claude Desktop

Add this to your claude_desktop_config.json:

json

{  "mcpServers": {    "npm-sentinel": {      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

{  "mcpServers": {    "npm-sentinel": {      "command": "npx",      "args": ["-y", "@nekzus/mcp-server@latest"]    }  }}

Configuration File Locations:

Windows: %APPDATA%\Claude\claude_desktop_config.json
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

Smithery.ai Deployment

json

{  "mcpServers": {    "npm-sentinel": {      "type": "http",      "url": "https://smithery.ai/server/@Nekzus/npm-sentinel-mcp"    }  }}

{  "mcpServers": {    "npm-sentinel": {      "type": "http",      "url": "https://smithery.ai/server/@Nekzus/npm-sentinel-mcp"    }  }}

Docker Usage

bash

# Build Docker imagedocker build -t nekzus/npm-sentinel-mcp .
# Run with local volume mountdocker run -i --rm -w /projects -v ${PWD}:/projects nekzus/npm-sentinel-mcp node dist/index.js

# Build Docker imagedocker build -t nekzus/npm-sentinel-mcp .
# Run with local volume mountdocker run -i --rm -w /projects -v ${PWD}:/projects nekzus/npm-sentinel-mcp node dist/index.js

Web Standard Streamable HTTP & Cloudflare Workers Integration

The package exports createMcpHttpHandler and WebStandardStreamableHTTPServerTransport for serverless platforms (Cloudflare Workers, Hono, Vercel, Express, Fastify, Next.js API routes) requiring official Web Standard Streamable HTTP transport under MCP v2:

typescript

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleMcpRequest = createMcpHttpHandler();
export default {  async fetch(request: Request): Promise<Response> {    return handleMcpRequest(request);  },};

import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleMcpRequest = createMcpHttpHandler();
export default {  async fetch(request: Request): Promise<Response> {    return handleMcpRequest(request);  },};

100% MCP v2 Compliance: Powered by WebStandardStreamableHTTPServerTransport, this handler natively activates all 3 MCP primitives (Tools, Resources, and Prompts) with peak performance, SSE streaming support, and full Web Standard Request $\rightarrow$ Response compatibility.

Configuration

The server supports the following configuration parameters:

MCP Server Capabilities (v2 API)

All tool responses conform to the MCP v2 dual output format, providing both human-readable text in content and parsed JSON objects in structuredContent:

json

{  "content": [    {      "type": "text",      "text": "{\n  \"queryPackages\": [\"express\"],\n  \"results\": [...]\n}"    }  ],  "structuredContent": {    "queryPackages": ["express"],    "results": [...]  }}

{  "content": [    {      "type": "text",      "text": "{\n  \"queryPackages\": [\"express\"],\n  \"results\": [...]\n}"    }  ],  "structuredContent": {    "queryPackages": ["express"],    "results": [...]  }}

Server Resources

Accessible via MCP readResource requests:

doc://server/readme
- Description: Main documentation file for NPM Sentinel MCP server.
- MIME Type: text/markdown
- Icon: Embedded Document SVG Data URI.
doc://mcp/specification
- Description: Complete Model Context Protocol specification file (llms-full.txt).
- MIME Type: text/plain
- Icon: Embedded Document SVG Data URI.

Server Prompts

Accessible via MCP getPrompt requests:

analyze-package
- Description: Generates a comprehensive prompt template for AI analysis of an NPM package including security, performance, dependencies, and health metrics.
- Arguments: package (string, required)
- Icon: Embedded Security SVG Data URI.

Tools Catalog (19 Tools)

All 19 tools define inputSchema, outputSchema, annotations (title, readOnlyHint), and icons:

1. `npmLatest`

Get latest version information, release dates, SRI integrity hashes, and dist-tags.
Input: packages (string[]), ignoreCache (boolean, optional)

2. `npmVersions`

Get full version history with release dates and deprecation statuses.
Input: packages (string[]), ignoreCache (boolean, optional)

3. `npmDeps`

Complete dependency tree analysis including direct dependencies and full transitive graph mapping via deps.dev.
Input: packages (string[]), ignoreCache (boolean, optional)

4. `npmTypes`

Verify TypeScript support (native index.d.ts declaration files vs @types/* DefinitelyTyped packages).
Input: packages (string[]), ignoreCache (boolean, optional)

5. `npmSize`

Package bundle size, minified size, and gzip impact analysis.
Input: packages (string[]), ignoreCache (boolean, optional)

6. `npmVulnerabilities`

Instant transitive vulnerability scanning powered by Google's deps.dev and OSV.dev advisories.
Input: packages (string[]), ignoreCache (boolean, optional)

7. `npmTrends`

Historical download statistics over customizable time ranges (last-week, last-month, last-year).
Input: packages (string[]), period ("last-week" | "last-month" | "last-year"), ignoreCache (boolean, optional)

8. `npmCompare`

Side-by-side metric comparison across multiple packages.
Input: packages (string[]), ignoreCache (boolean, optional)

9. `npmMaintainers`

List of package maintainers, public emails, and publishing activity.
Input: packages (string[]), ignoreCache (boolean, optional)

10. `npmScore`

Consolidated score combining quality, popularity, maintenance, and OpenSSF Scorecard.
Input: packages (string[]), ignoreCache (boolean, optional)

11. `npmPackageReadme`

Retrieve full formatted raw README markdown content from NPM registry / CDN.
Input: packages (string[]), ignoreCache (boolean, optional)

12. `npmSearch`

Search NPM registry packages by query with rich metadata (scores, publisher, keywords).
Input: query (string), limit (number, optional)

13. `npmLicenseCompatibility`

Analyze license compatibility across multiple packages (MIT, Apache-2.0, GPL, etc.).
Input: packages (string[]), ignoreCache (boolean, optional)

14. `npmRepoStats`

Repository statistics (GitHub stars, forks, open issues) combined with OpenSSF Scorecard checks.
Input: packages (string[]), ignoreCache (boolean, optional)

15. `npmDeprecated`

Detect deprecation status on package and recursive sub-dependencies.
Input: packages (string[]), ignoreCache (boolean, optional)

16. `npmChangelogAnalysis`

Extract release notes and GitHub release history.
Input: packages (string[]), ignoreCache (boolean, optional)

17. `npmAlternatives`

Smart functional alternative suggestions filtering out ecosystem plugins (e.g. excludes express-rate-limit for express).
Input: packages (string[]), ignoreCache (boolean, optional)

18. `npmQuality`

Package code quality score (0–1).
Input: packages (string[]), ignoreCache (boolean, optional)

19. `npmMaintenance`

Package maintenance activity score (0–1).
Input: packages (string[]), ignoreCache (boolean, optional)

License

This MCP server is licensed under the MIT License. See LICENSE for details.

MIT © nekzus

來源：README.md，提交 98964a1

工具

該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

v1.11.8最新Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

近 30 天內可連通必需25 分
已宣告認證方式必需10 分
已列出工具15 分
請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。
描述必需15 分
圖示10 分
文件15 分
授權條款10 分

其他 Smithery 整合

222wcnm Bilistalkermcp

ai.smithery官方發布者

Bilibili 創作者分析伺服器，讓助理查詢指定使用者的個人資料、影片、動態、專欄、字幕、追蹤清單與留言。

Streamable HTTP可網頁執行

知識與記憶尚未收錄Oct 24, 2026

Zwldarren Akshare One Mcp

ai.smithery官方發布者

遠端 MCP 伺服器，讓助理以唯讀方式取得中國股市資料：歷史與即時行情、新聞和財務報表。

Streamable HTTP可網頁執行驗證方式

金融需要憑證Oct 24, 2026

Zhaoganghao Hellomcp

ai.smithery官方發布者

一個小型遠端 MCP 伺服器，讓助理依名字向人問候，並介紹「Hello, World」的由來。

Streamable HTTP可網頁執行

尚未收錄Oct 24, 2026

Zeta Chain Cli

ai.smithery官方發布者

一個遠端 MCP 伺服器，讓助理為任意姓名或受眾產生友善、可自訂的問候語。

Streamable HTTP可網頁執行驗證方式

需要憑證Oct 24, 2026

Yuna0x0 Hackmd Mcp

ai.smithery官方發布者

一個連接 HackMD API 的 MCP 伺服器，讓助理讀取、建立、更新和刪除 HackMD 筆記並管理團隊。

Streamable HTTP可網頁執行

溝通與協作尚未收錄Oct 25, 2026

Nekzus Npm Sentinel Mcp

概覽

安裝

在 SourceWeft 中

交給代理程式安裝

其他 MCP 客戶端

README

NPM Sentinel MCP

Key Features

Security & OWASP LLM01 Compliance

Example Usage (JSON-RPC)

Installation & Transports

Dual-Era MCP Architecture (v1 2025-11-25 + v2 2026-07-28)

Install in VS Code / Cursor

Install in Claude Desktop

Smithery.ai Deployment

Docker Usage

Web Standard Streamable HTTP & Cloudflare Workers Integration

Configuration

MCP Server Capabilities (v2 API)

Server Resources

Server Prompts

Tools Catalog (19 Tools)

1. npmLatest

2. npmVersions

3. npmDeps

4. npmTypes

5. npmSize

6. npmVulnerabilities

7. npmTrends

8. npmCompare

9. npmMaintainers

10. npmScore

11. npmPackageReadme

12. npmSearch

13. npmLicenseCompatibility

14. npmRepoStats

15. npmDeprecated

16. npmChangelogAnalysis

17. npmAlternatives

18. npmQuality

19. npmMaintenance

License

工具

版本歷史

評分

其他 Smithery 整合

222wcnm Bilistalkermcp

Zwldarren Akshare One Mcp

Zhaoganghao Hellomcp

Zeta Chain Cli

Yuna0x0 Hackmd Mcp

Dual-Era MCP Architecture (v1 `2025-11-25` + v2 `2026-07-28`)

1. `npmLatest`

2. `npmVersions`

3. `npmDeps`

4. `npmTypes`

5. `npmSize`

6. `npmVulnerabilities`

7. `npmTrends`

8. `npmCompare`

9. `npmMaintainers`

10. `npmScore`

11. `npmPackageReadme`

12. `npmSearch`

13. `npmLicenseCompatibility`

14. `npmRepoStats`

15. `npmDeprecated`

16. `npmChangelogAnalysis`

17. `npmAlternatives`

18. `npmQuality`

19. `npmMaintenance`