# io.github.mikusnuz/npm (npm · @mikusnuz/npm-mcp)

MCP server for npm package management — publish, version, search, audit, and more

- Trust score: 66/100 (medium)
- Change this week: +13
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@mikusnuz/npm-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/mikusnuz-npm/mikusnuz-npm-mcp.md), [page](https://verifymcp.io/servers/mikusnuz-npm/mikusnuz-npm-mcp)

## Channel facts

- Registry: `npm`
- Package: `@mikusnuz/npm-mcp`
- Version: `1.2.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 136 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2084 tokens (~53/item across 39 items; 38 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add mikusnuz-npm -- npx -y @mikusnuz/npm-mcp
```

### Codex

```bash
codex mcp add mikusnuz-npm -- npx -y @mikusnuz/npm-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mikusnuz-npm": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mikusnuz/npm-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mikusnuz-npm --command npx --arg -y --arg @mikusnuz/npm-mcp
```

### Hermes

```yaml
mcp_servers:
  mikusnuz-npm:
    command: "npx"
    args: ["-y", "@mikusnuz/npm-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "mikusnuz-npm": {
      "command": "npx",
      "args": [
        "-y",
        "@mikusnuz/npm-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +40)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 26, +21)

- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-31 (score 5, −30)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 35, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (38)

### `publish` (~80 tokens)

Publish a package to the npm registry

Input parameters:

- `access` (string): Access level for scoped packages
- `dryRun` (boolean): Run publish without actually publishing
- `otp` (string): One-time password for 2FA
- `path` (string, required): Absolute path to the package directory
- `tag` (string): Dist-tag (default: latest)

### `version` (~68 tokens)

Bump the package version

Input parameters:

- `bump` (string, required): Version bump type
- `noGitTag` (boolean): Skip git tag creation
- `path` (string, required): Absolute path to the package directory
- `preid` (string): Prerelease identifier (e.g. alpha, beta)

### `view` (~51 tokens)

View package information from the registry

Input parameters:

- `field` (string): Specific field to view (e.g. versions, dist-tags)
- `package` (string, required): Package name (e.g. react, @scope/pkg)

### `search` (~35 tokens)

Search npm registry for packages

Input parameters:

- `limit` (number): Max results (default 20)
- `query` (string, required): Search query

### `unpublish` (~68 tokens)

Remove a package version from the registry

Input parameters:

- `force` (boolean): Force unpublish (required for entire package)
- `otp` (string): One-time password for 2FA
- `package` (string, required): Package name with optional version (e.g. pkg@1.0.0)

### `deprecate` (~74 tokens)

Deprecate a version of a package

Input parameters:

- `message` (string, required): Deprecation message (empty string to undeprecate)
- `otp` (string): One-time password for 2FA
- `package` (string, required): Package@version range (e.g. pkg@<1.0.0)

### `owner` (~58 tokens)

Manage package owners

Input parameters:

- `action` (string, required): Action to perform
- `otp` (string): One-time password for 2FA
- `package` (string, required): Package name
- `user` (string): Username (required for add/rm)

### `dist-tag` (~53 tokens)

Manage distribution tags

Input parameters:

- `action` (string, required): Action to perform
- `package` (string, required): Package name (for add: pkg@version)
- `tag` (string): Tag name (required for add/rm)

### `pack` (~48 tokens)

Create a tarball from a package (preview what would be published)

Input parameters:

- `dryRun` (boolean): List files without creating tarball
- `path` (string, required): Absolute path to the package directory

### `whoami` (~31 tokens)

Check which npm user is currently authenticated. If not logged in, set NPM_TOKEN env var in MCP config.

### `init` (~43 tokens)

Initialize a new package.json

Input parameters:

- `path` (string, required): Absolute path to the directory
- `scope` (string): Scope for the package (e.g. @myorg)

### `audit` (~61 tokens)

Run a security audit on the package

Input parameters:

- `fix` (boolean): Automatically fix vulnerabilities
- `level` (string): Minimum vulnerability level to report
- `path` (string, required): Absolute path to the package directory
- `production` (boolean): Only audit production dependencies

### `outdated` (~48 tokens)

Check for outdated packages in a project

Input parameters:

- `global` (boolean): Check global packages
- `long` (boolean): Show extended information
- `path` (string, required): Absolute path to the package directory

### `ls` (~90 tokens)

List installed packages in a project

Input parameters:

- `all` (boolean): Show all packages, not just top-level
- `depth` (number): Dependency tree depth (default: 0)
- `global` (boolean): List global packages
- `package` (string): Specific package to look for
- `path` (string, required): Absolute path to the package directory
- `production` (boolean): Only show production dependencies

### `install` (~95 tokens)

Install packages in a project

Input parameters:

- `dryRun` (boolean): Preview install without making changes
- `global` (boolean): Install globally
- `packages` (array): Package names to install (empty = install all from package.json)
- `path` (string, required): Absolute path to the package directory
- `saveDev` (boolean): Save as devDependency
- `saveExact` (boolean): Save exact version instead of semver range

### `uninstall` (~48 tokens)

Remove packages from a project

Input parameters:

- `global` (boolean): Uninstall from global
- `packages` (array, required): Package names to uninstall
- `path` (string, required): Absolute path to the package directory

### `update` (~72 tokens)

Update packages in a project to their latest semver-compatible version

Input parameters:

- `dryRun` (boolean): Preview updates without making changes
- `global` (boolean): Update global packages
- `packages` (array): Specific packages to update (empty = update all)
- `path` (string, required): Absolute path to the package directory

### `access` (~94 tokens)

Set or view access level on published packages

Input parameters:

- `action` (string, required): Action to perform
- `level` (string): Access level (for set action)
- `otp` (string): One-time password for 2FA
- `package` (string): Package name
- `permission` (string): Permission level (for grant action)
- `team` (string): Team name in org:team format (for grant/revoke)

### `token` (~55 tokens)

Manage npm access tokens (list or revoke)

Input parameters:

- `action` (string, required): Action to perform
- `otp` (string): One-time password for 2FA
- `token` (string): Token ID to revoke (required for revoke)

### `ping` (~14 tokens)

Check connectivity to the npm registry

### `bugs` (~25 tokens)

Get the bug tracker URL for a package

Input parameters:

- `package` (string, required): Package name

### `repo` (~24 tokens)

Get the repository URL for a package

Input parameters:

- `package` (string, required): Package name

### `docs` (~24 tokens)

Get the documentation URL for a package

Input parameters:

- `package` (string, required): Package name

### `diff` (~114 tokens)

Show diff between package versions or between local and registry

Input parameters:

- `diffNameOnly` (boolean): Only show file names that changed
- `package` (string): Package spec for comparison (e.g. pkg@1.0.0..pkg@2.0.0)
- `path` (string): Absolute path to local package (compares local vs registry)
- `specs` (array): Two package specs to compare (e.g. ['pkg@1.0.0', 'pkg@2.0.0'])

### `pkg` (~81 tokens)

Manage package.json fields programmatically

Input parameters:

- `action` (string, required): Action to perform
- `field` (string, required): Field name (e.g. 'name', 'scripts.build', 'keywords')
- `path` (string, required): Absolute path to the package directory
- `value` (string): Value to set (required for set action, use JSON for objects/arrays)

### `fund` (~38 tokens)

Show funding information for installed packages

Input parameters:

- `package` (string): Specific package to check
- `path` (string, required): Absolute path to the package directory

### `dedupe` (~41 tokens)

Reduce duplication in the dependency tree

Input parameters:

- `dryRun` (boolean): Preview changes without making them
- `path` (string, required): Absolute path to the package directory

### `explain` (~42 tokens)

Explain why a package is installed (show dependency chain)

Input parameters:

- `package` (string, required): Package name to explain
- `path` (string, required): Absolute path to the package directory

### `sbom` (~62 tokens)

Generate a Software Bill of Materials (SBOM) for a project

Input parameters:

- `format` (string): SBOM format (default: cyclonedx)
- `path` (string, required): Absolute path to the package directory
- `production` (boolean): Only include production dependencies

### `profile` (~76 tokens)

View or modify npm user profile settings

Input parameters:

- `action` (string, required): Action to perform
- `field` (string): Profile field to get or set (e.g. email, fullname, homepage)
- `otp` (string): One-time password for 2FA
- `value` (string): Value to set (required for set action)

### `ci` (~31 tokens)

Clean install dependencies from lockfile (for CI environments)

Input parameters:

- `path` (string, required): Absolute path to the package directory

### `run-script` (~59 tokens)

Run a script defined in package.json

Input parameters:

- `args` (array): Arguments to pass to the script
- `path` (string, required): Absolute path to the package directory
- `script` (string): Script name to run (omit to list available scripts)

### `doctor` (~15 tokens)

Run diagnostics to check npm environment health

### `cache` (~49 tokens)

Manage the npm cache

Input parameters:

- `action` (string, required): Action: clean (clear cache), verify (check integrity), ls (list contents)
- `force` (boolean): Force clean (required for clean action)

### `config` (~52 tokens)

View npm configuration (read-only for safety)

Input parameters:

- `action` (string, required): Action: list (show all config), get (get specific key)
- `key` (string): Config key to get (required for get action)

### `prune` (~53 tokens)

Remove extraneous packages not listed in package.json

Input parameters:

- `dryRun` (boolean): Preview changes without making them
- `path` (string, required): Absolute path to the package directory
- `production` (boolean): Remove devDependencies

### `link` (~46 tokens)

Symlink a local package for development

Input parameters:

- `package` (string): Package name to link (omit to link current dir globally)
- `path` (string, required): Absolute path to the package directory

### `query` (~54 tokens)

Query installed packages using CSS-like selectors

Input parameters:

- `path` (string, required): Absolute path to the package directory
- `selector` (string, required): CSS-like dependency selector (e.g. ':root > .prod', '.dev', '#lodash')

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mikusnuz-npm/mikusnuz-npm-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 26
- 2026-07-31: 5
- 2026-07-30: 35
- 2026-07-28: 53
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/@mikusnuz/npm-mcp
- Socket report: https://socket.dev/npm/package/@mikusnuz/npm-mcp
- Repository: https://github.com/mikusnuz/npm-mcp
- Changelog RSS feed: https://verifymcp.io/servers/mikusnuz-npm/mikusnuz-npm-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mikusnuz-npm/mikusnuz-npm-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mikusnuz-npm/mikusnuz-npm-mcp