How to install NPMScan in Cursor

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Indexed, not yet reviewed

We found NPMScan in the official MCP registry. Our automated check passed on Nov 1, 2026 (it confirms the server is published and reachable), but no one at CuratedMCP has reviewed its code, permissions or credentials handling. Check what it can access before you give it keys. Scan your machine free to see every MCP server you have installed.

Steps

1Open .cursor/mcp.json in your project (or ~/.cursor/mcp.json for all projects)
2Add the entry below. If the file already has "mcpServers", add just the inner entry
3Check Cursor Settings → MCP and enable the server

Configuration

.cursor/mcp.json

{
  "mcpServers": {
    "npmscan-mcp-plugin": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

Install in other clients

Claude Code Claude Desktop Windsurf Gemini CLI OpenAI Agents SDK

About NPMScan: repo, license and check results →

Maintain NPMScan?

Claim this page to get a full CuratedMCP listing: edit your description, see listing analytics, and add our README badge. Listing is free, and a person checks every submission before it goes live. We'll pre-fill the form from the registry.

Claim this listing What maintainers get