How to install NPMScan in Gemini CLI

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Indexed, not yet reviewed

We found NPMScan in the official MCP registry. Our automated check passed on Nov 1, 2026 (it confirms the server is published and reachable), but no one at CuratedMCP has reviewed its code, permissions or credentials handling. Check what it can access before you give it keys. Scan your machine free to see every MCP server you have installed.

Steps

1Open ~/.gemini/settings.json (or .gemini/settings.json in your project)
2Add the entry below. If the file already has "mcpServers", add just the inner entry
3Restart Gemini CLI and run /mcp to confirm

Configuration

~/.gemini/settings.json

{
  "mcpServers": {
    "npmscan-mcp-plugin": {
      "httpUrl": "https://npmscan.com/api/mcp"
    }
  }
}

Install in other clients

Claude Code Cursor Claude Desktop Windsurf OpenAI Agents SDK

About NPMScan: repo, license and check results →

Maintain NPMScan?

Claim this page to get a full CuratedMCP listing: edit your description, see listing analytics, and add our README badge. Listing is free, and a person checks every submission before it goes live. We'll pre-fill the form from the registry.

Claim this listing What maintainers get