I Added an MCP Server to NPMScan for AI Coding Agents

NPMScan has launched a public MCP server that allows AI coding agents to query npm package metadata, versions, install scripts, maintainers, known vulnerabilities, and recent security advisories. The server is read-only and requires no API key, enabling agents to check package security before recommending or installing dependencies.

AI coding agents are increasingly choosing libraries, installing dependencies, and modifying package.json files. But when an agent recommends an npm package, it may rely on model knowledge, general web search, or incomplete package information. I wanted NPMScan to be available directly inside that workflow. NPMScan now has a public MCP server that allows compatible AI agents to query npm package metadata, versions, install scripts, maintainers, known vulnerabilities, and recent security advisories. https://npmscan.com/api/mcp The server is public, read-only, and does not require an API key. Run: claude mcp add --transport http npmscan https://npmscan.com/api/mcp You can then confirm that the server is available: claude mcp list The current MCP integration exposes tools for: The available tools currently include: search packages get package get package version query vulnerabilities batch query vulnerabilities get latest advisories After connecting NPMScan, you can ask your coding agent: Check the axios package for known vulnerabilities before installing it. Compare axios and ky from a package security perspective. Inspect the install scripts and maintainers for this npm package. Check these dependencies for known vulnerabilities: axios, express, lodash, jsonwebtoken Show me the latest npm security advisories. The agent can query NPMScan directly instead of asking you to leave the editor, open another website, and manually investigate each package. AI agents are becoming part of the dependency selection process. That creates a simple problem: agents need access to structured security information before they recommend or install a package. Package popularity is not enough. A package can have: The goal of the NPMScan MCP server is to make those checks easier to include in AI-assisted development workflows. It does not replace manual security review, but it gives agents a better source of package intelligence than relying only on generated knowledge. Clients that support remote HTTP MCP servers can use: { "mcpServers": { "npmscan": { "type": "http", "url": "https://npmscan.com/api/mcp" } } } For clients that only support local stdio servers, you can use an MCP remote bridge: { "mcpServers": { "npmscan": { "command": "npx", "args": "-y", "mcp-remote", "https://npmscan.com/api/mcp" } } } MCP documentation: NPMScan: I would appreciate feedback from developers using MCP with Claude Code, Cursor, or other coding agents. What additional npm security checks would be most useful inside your agent workflow?