{"slug": "i-added-an-mcp-server-to-npmscan-for-ai-coding-agents", "title": "I Added an MCP Server to NPMScan for AI Coding Agents", "summary": "NPMScan has launched a public MCP server that allows AI coding agents to query npm package metadata, versions, install scripts, maintainers, known vulnerabilities, and recent security advisories. The server is read-only and requires no API key, enabling agents to check package security before recommending or installing dependencies.", "body_md": "AI coding agents are increasingly choosing libraries, installing dependencies, and modifying `package.json`\n\nfiles.\n\nBut when an agent recommends an npm package, it may rely on model knowledge, general web search, or incomplete package information.\n\nI wanted NPMScan to be available directly inside that workflow.\n\nNPMScan now has a public MCP server that allows compatible AI agents to query npm package metadata, versions, install scripts, maintainers, known vulnerabilities, and recent security advisories.\n\n```\nhttps://npmscan.com/api/mcp\n```\n\nThe server is public, read-only, and does not require an API key.\n\nRun:\n\n```\nclaude mcp add --transport http npmscan https://npmscan.com/api/mcp\n```\n\nYou can then confirm that the server is available:\n\n```\nclaude mcp list\n```\n\nThe current MCP integration exposes tools for:\n\nThe available tools currently include:\n\n```\nsearch_packages\nget_package\nget_package_version\nquery_vulnerabilities\nbatch_query_vulnerabilities\nget_latest_advisories\n```\n\nAfter connecting NPMScan, you can ask your coding agent:\n\n```\nCheck the axios package for known vulnerabilities before installing it.\nCompare axios and ky from a package security perspective.\nInspect the install scripts and maintainers for this npm package.\nCheck these dependencies for known vulnerabilities:\naxios, express, lodash, jsonwebtoken\nShow me the latest npm security advisories.\n```\n\nThe agent can query NPMScan directly instead of asking you to leave the editor, open another website, and manually investigate each package.\n\nAI agents are becoming part of the dependency selection process.\n\nThat creates a simple problem: agents need access to structured security information before they recommend or install a package.\n\nPackage popularity is not enough.\n\nA package can have:\n\nThe goal of the NPMScan MCP server is to make those checks easier to include in AI-assisted development workflows.\n\nIt does not replace manual security review, but it gives agents a better source of package intelligence than relying only on generated knowledge.\n\nClients that support remote HTTP MCP servers can use:\n\n```\n{\n  \"mcpServers\": {\n    \"npmscan\": {\n      \"type\": \"http\",\n      \"url\": \"https://npmscan.com/api/mcp\"\n    }\n  }\n}\n```\n\nFor clients that only support local `stdio`\n\nservers, you can use an MCP remote bridge:\n\n```\n{\n  \"mcpServers\": {\n    \"npmscan\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"mcp-remote\",\n        \"https://npmscan.com/api/mcp\"\n      ]\n    }\n  }\n}\n```\n\nMCP documentation:\n\nNPMScan:\n\nI would appreciate feedback from developers using MCP with Claude Code, Cursor, or other coding agents.\n\nWhat additional npm security checks would be most useful inside your agent workflow?", "url": "https://wpnews.pro/news/i-added-an-mcp-server-to-npmscan-for-ai-coding-agents", "canonical_source": "https://dev.to/block_hacks/i-added-an-mcp-server-to-npmscan-for-ai-coding-agents-njp", "published_at": "2026-07-28 22:53:25+00:00", "updated_at": "2026-07-28 23:31:51.779622+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools", "ai-safety"], "entities": ["NPMScan", "Claude Code", "Cursor"], "alternates": {"html": "https://wpnews.pro/news/i-added-an-mcp-server-to-npmscan-for-ai-coding-agents", "markdown": "https://wpnews.pro/news/i-added-an-mcp-server-to-npmscan-for-ai-coding-agents.md", "text": "https://wpnews.pro/news/i-added-an-mcp-server-to-npmscan-for-ai-coding-agents.txt", "jsonld": "https://wpnews.pro/news/i-added-an-mcp-server-to-npmscan-for-ai-coding-agents.jsonld"}}