How to install NPMScan in Windsurf

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Indexed, not yet reviewed

We found NPMScan in the official MCP registry. Our automated check passed on Nov 1, 2026 (it confirms the server is published and reachable), but no one at CuratedMCP has reviewed its code, permissions or credentials handling. Check what it can access before you give it keys. Scan your machine free to see every MCP server you have installed.

Steps

1Open ~/.codeium/windsurf/mcp_config.json
2Add the entry below. If the file already has "mcpServers", add just the inner entry
3Refresh the MCP servers list in Windsurf's Cascade panel

Configuration

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "npmscan-mcp-plugin": {
      "serverUrl": "https://npmscan.com/api/mcp"
    }
  }
}

Install in other clients

Claude Code Cursor Claude Desktop Gemini CLI OpenAI Agents SDK

About NPMScan: repo, license and check results →

Maintain NPMScan?

Claim this page to get a full CuratedMCP listing: edit your description, see listing analytics, and add our README badge. Listing is free, and a person checks every submission before it goes live. We'll pre-fill the form from the registry.

Claim this listing What maintainers get