AI coding agents are increasingly choosing libraries, installing dependencies, and modifying package.json
files.
But when an agent recommends an npm package, it may rely on model knowledge, general web search, or incomplete package information.
I wanted NPMScan to be available directly inside that workflow.
NPMScan now has a public MCP server that allows compatible AI agents to query npm package metadata, versions, install scripts, maintainers, known vulnerabilities, and recent security advisories.
https://npmscan.com/api/mcp
The server is public, read-only, and does not require an API key.
Run:
claude mcp add --transport http npmscan https://npmscan.com/api/mcp
You can then confirm that the server is available:
claude mcp list
The current MCP integration exposes tools for:
The available tools currently include:
search_packages
get_package
get_package_version
query_vulnerabilities
batch_query_vulnerabilities
get_latest_advisories
After connecting NPMScan, you can ask your coding agent:
Check the axios package for known vulnerabilities before installing it.
Compare axios and ky from a package security perspective.
Inspect the install scripts and maintainers for this npm package.
Check these dependencies for known vulnerabilities:
axios, express, lodash, jsonwebtoken
Show me the latest npm security advisories.
The agent can query NPMScan directly instead of asking you to leave the editor, open another website, and manually investigate each package.
AI agents are becoming part of the dependency selection process.
That creates a simple problem: agents need access to structured security information before they recommend or install a package.
Package popularity is not enough.
A package can have:
The goal of the NPMScan MCP server is to make those checks easier to include in AI-assisted development workflows.
It does not replace manual security review, but it gives agents a better source of package intelligence than relying only on generated knowledge.
Clients that support remote HTTP MCP servers can use:
{
"mcpServers": {
"npmscan": {
"type": "http",
"url": "https://npmscan.com/api/mcp"
}
}
}
For clients that only support local stdio
servers, you can use an MCP remote bridge:
{
"mcpServers": {
"npmscan": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://npmscan.com/api/mcp"
]
}
}
}
MCP documentation:
NPMScan:
I would appreciate feedback from developers using MCP with Claude Code, Cursor, or other coding agents.
What additional npm security checks would be most useful inside your agent workflow?