io.github.mikusnuz/npm

NPM · @MIKUSNUZ/NPM-MCP · SCANNED AUG 3

MCP server for npm package management — publish, version, search, audit, and more

Available components

+13 this week 66 66 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 136 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability81

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 2084 tokens (~53/item across 39 items; 38 tools + 1 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @mikusnuz/npm-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add mikusnuz-npm -- npx -y @mikusnuz/npm-mcp

# add to Codex CLI

codex mcp add mikusnuz-npm -- npx -y @mikusnuz/npm-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mikusnuz-npm": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mikusnuz/npm-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add mikusnuz-npm --command npx --arg -y --arg @mikusnuz/npm-mcp

# ~/.hermes/config.yaml

mcp_servers:
  mikusnuz-npm:
    command: "npx"
    args: ["-y", "@mikusnuz/npm-mcp"]

// mcp.json

{
  "mcpServers": {
    "mikusnuz-npm": {
      "command": "npx",
      "args": [
        "-y",
        "@mikusnuz/npm-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +40
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
- Licence: MIT functional
1 Aug 26 +21
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
31 Jul 26 −30
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
27 Jul 26 53

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@mikusnuz/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 38 exposed · ~2,072 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

access ~94

Set or view access level on published packages

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
level	string	—	Access level (for set action)
otp	string	—	One-time password for 2FA
package	string	—	Package name
permission	string	—	Permission level (for grant action)
team	string	—	Team name in org:team format (for grant/revoke)

No output schema declared.

No examples provided.

audit ~61

Run a security audit on the package

Input Output Examples

Name	Type	Req	Description
fix	boolean	—	Automatically fix vulnerabilities
level	string	—	Minimum vulnerability level to report
path	string	yes	Absolute path to the package directory
production	boolean	—	Only audit production dependencies

No output schema declared.

No examples provided.

bugs ~25

Get the bug tracker URL for a package

Input Output Examples

Name	Type	Req	Description
package	string	yes	Package name

No output schema declared.

No examples provided.

cache ~49

Manage the npm cache

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action: clean (clear cache), verify (check integrity), ls (list contents)
force	boolean	—	Force clean (required for clean action)

No output schema declared.

No examples provided.

ci ~31

Clean install dependencies from lockfile (for CI environments)

Input Output Examples

Name	Type	Req	Description
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

config ~52

View npm configuration (read-only for safety)

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action: list (show all config), get (get specific key)
key	string	—	Config key to get (required for get action)

No output schema declared.

No examples provided.

dedupe ~41

Reduce duplication in the dependency tree

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	Preview changes without making them
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

deprecate ~74

Deprecate a version of a package

Input Output Examples

Name	Type	Req	Description
message	string	yes	Deprecation message (empty string to undeprecate)
otp	string	—	One-time password for 2FA
package	string	yes	Package@version range (e.g. pkg@<1.0.0)

No output schema declared.

No examples provided.

diff ~114

Show diff between package versions or between local and registry

Input Output Examples

Name	Type	Req	Description
diffNameOnly	boolean	—	Only show file names that changed
package	string	—	Package spec for comparison (e.g. [email protected]@2.0.0)
path	string	—	Absolute path to local package (compares local vs registry)
specs	array	—	Two package specs to compare (e.g. ['[email protected]', '[email protected]'])

No output schema declared.

No examples provided.

dist-tag ~53

Manage distribution tags

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
package	string	yes	Package name (for add: pkg@version)
tag	string	—	Tag name (required for add/rm)

No output schema declared.

No examples provided.

docs ~24

Get the documentation URL for a package

Input Output Examples

Name	Type	Req	Description
package	string	yes	Package name

No output schema declared.

No examples provided.

doctor ~15

Run diagnostics to check npm environment health

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

explain ~42

Explain why a package is installed (show dependency chain)

Input Output Examples

Name	Type	Req	Description
package	string	yes	Package name to explain
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

fund ~38

Show funding information for installed packages

Input Output Examples

Name	Type	Req	Description
package	string	—	Specific package to check
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

init ~43

Initialize a new package.json

Input Output Examples

Name	Type	Req	Description
path	string	yes	Absolute path to the directory
scope	string	—	Scope for the package (e.g. @myorg)

No output schema declared.

No examples provided.

install ~95

Install packages in a project

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	Preview install without making changes
global	boolean	—	Install globally
packages	array	—	Package names to install (empty = install all from package.json)
path	string	yes	Absolute path to the package directory
saveDev	boolean	—	Save as devDependency
saveExact	boolean	—	Save exact version instead of semver range

No output schema declared.

No examples provided.

link ~46

Symlink a local package for development

Input Output Examples

Name	Type	Req	Description
package	string	—	Package name to link (omit to link current dir globally)
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

ls ~90

List installed packages in a project

Input Output Examples

Name	Type	Req	Description
all	boolean	—	Show all packages, not just top-level
depth	number	—	Dependency tree depth (default: 0)
global	boolean	—	List global packages
package	string	—	Specific package to look for
path	string	yes	Absolute path to the package directory
production	boolean	—	Only show production dependencies

No output schema declared.

No examples provided.

outdated ~48

Check for outdated packages in a project

Input Output Examples

Name	Type	Req	Description
global	boolean	—	Check global packages
long	boolean	—	Show extended information
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

owner ~58

Manage package owners

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
otp	string	—	One-time password for 2FA
package	string	yes	Package name
user	string	—	Username (required for add/rm)

No output schema declared.

No examples provided.

pack ~48

Create a tarball from a package (preview what would be published)

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	List files without creating tarball
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

ping ~14

Check connectivity to the npm registry

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

pkg ~81

Manage package.json fields programmatically

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
field	string	yes	Field name (e.g. 'name', 'scripts.build', 'keywords')
path	string	yes	Absolute path to the package directory
value	string	—	Value to set (required for set action, use JSON for objects/arrays)

No output schema declared.

No examples provided.

profile ~76

View or modify npm user profile settings

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
field	string	—	Profile field to get or set (e.g. email, fullname, homepage)
otp	string	—	One-time password for 2FA
value	string	—	Value to set (required for set action)

No output schema declared.

No examples provided.

prune ~53

Remove extraneous packages not listed in package.json

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	Preview changes without making them
path	string	yes	Absolute path to the package directory
production	boolean	—	Remove devDependencies

No output schema declared.

No examples provided.

publish ~80

Publish a package to the npm registry

Input Output Examples

Name	Type	Req	Description
access	string	—	Access level for scoped packages
dryRun	boolean	—	Run publish without actually publishing
otp	string	—	One-time password for 2FA
path	string	yes	Absolute path to the package directory
tag	string	—	Dist-tag (default: latest)

No output schema declared.

No examples provided.

query ~54

Query installed packages using CSS-like selectors

Input Output Examples

Name	Type	Req	Description
path	string	yes	Absolute path to the package directory
selector	string	yes	CSS-like dependency selector (e.g. ':root > .prod', '.dev', '#lodash')

No output schema declared.

No examples provided.

repo ~24

Get the repository URL for a package

Input Output Examples

Name	Type	Req	Description
package	string	yes	Package name

No output schema declared.

No examples provided.

run-script ~59

Run a script defined in package.json

Input Output Examples

Name	Type	Req	Description
args	array	—	Arguments to pass to the script
path	string	yes	Absolute path to the package directory
script	string	—	Script name to run (omit to list available scripts)

No output schema declared.

No examples provided.

sbom ~62

Generate a Software Bill of Materials (SBOM) for a project

Input Output Examples

Name	Type	Req	Description
format	string	—	SBOM format (default: cyclonedx)
path	string	yes	Absolute path to the package directory
production	boolean	—	Only include production dependencies

No output schema declared.

No examples provided.

search ~35

Search npm registry for packages

Input Output Examples

Name	Type	Req	Description
limit	number	—	Max results (default 20)
query	string	yes	Search query

No output schema declared.

No examples provided.

token ~55

Manage npm access tokens (list or revoke)

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
otp	string	—	One-time password for 2FA
token	string	—	Token ID to revoke (required for revoke)

No output schema declared.

No examples provided.

uninstall ~48

Remove packages from a project

Input Output Examples

Name	Type	Req	Description
global	boolean	—	Uninstall from global
packages	array	yes	Package names to uninstall
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

unpublish ~68

Remove a package version from the registry

Input Output Examples

Name	Type	Req	Description
force	boolean	—	Force unpublish (required for entire package)
otp	string	—	One-time password for 2FA
package	string	yes	Package name with optional version (e.g. [email protected])

No output schema declared.

No examples provided.

update ~72

Update packages in a project to their latest semver-compatible version

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	Preview updates without making changes
global	boolean	—	Update global packages
packages	array	—	Specific packages to update (empty = update all)
path	string	yes	Absolute path to the package directory

No output schema declared.

No examples provided.

version ~68

Bump the package version

Input Output Examples

Name	Type	Req	Description
bump	string	yes	Version bump type
noGitTag	boolean	—	Skip git tag creation
path	string	yes	Absolute path to the package directory
preid	string	—	Prerelease identifier (e.g. alpha, beta)

No output schema declared.

No examples provided.

view ~51

View package information from the registry

Input Output Examples

Name	Type	Req	Description
field	string	—	Specific field to view (e.g. versions, dist-tags)
package	string	yes	Package name (e.g. react, @scope/pkg)

No output schema declared.

No examples provided.

whoami ~31

Check which npm user is currently authenticated. If not logged in, set NPM_TOKEN env var in MCP config.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug