NPMScan MCP server

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Indexed, not yet reviewed

We found NPMScan in the official MCP registry. Our automated check passed on Nov 1, 2026 (it confirms the server is published and reachable), but no one at CuratedMCP has reviewed its code, permissions or credentials handling. Check what it can access before you give it keys. Scan your machine free to see every MCP server you have installed.

Install guides

Install in Claude Code Install in Cursor Install in Claude Desktop Install in Windsurf Install in Gemini CLI Install in OpenAI Agents SDK

At a glance

Repository: salemalem/npmscan-mcp-plugin
GitHub stars: 507
License: MIT
Last push: Nov 1, 2026
Hosted endpoint: https://npmscan.com/api/mcp
Website: npmscan.com

Automated check

Repository active, pushed this month
Endpoint responds (HTTP 405)

This checks that the server is published and reachable. It is not a security review. Source: the official MCP registry (io.github.salemalem/npmscan) and GitHub.

Maintain NPMScan?

Claim this page to get a full CuratedMCP listing: edit your description, see listing analytics, and add our README badge. Listing is free, and a person checks every submission before it goes live. We'll pre-fill the form from the registry.

Claim this listing What maintainers get

Related servers

nx-console

A Model Context Protocol server implementation for Nx

obsei

Self-hosted customer feedback with PII stripped at ingest: search, stats and themes with citations.

obsidian-mcp-server

Read, write, search, and surgically edit Obsidian notes, tags, and frontmatter via MCP.

Octocode

AI-powered code indexer with semantic search and knowledge graphs