io.github.Nekzus/npm-sentinel-mcp

NPM · @NEKZUS/MCP-SERVER · SCANNED AUG 3

Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.

Available components

+5 this week 81 81 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
No install/post-install scripts declared.Pass
10 of 10 dependencies flagged as unhealthy (10 deprecated). View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to Nekzus/npm-sentinel-mcp). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 3 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability82

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 1075 tokens (~51/item across 21 items; 19 tools + 2 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass
Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a current MCP spec version (2026-07-28).Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @nekzus/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add nekzus-npm-sentinel-mcp -- npx -y @nekzus/mcp-server

# add to Codex CLI

codex mcp add nekzus-npm-sentinel-mcp -- npx -y @nekzus/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nekzus-npm-sentinel-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@nekzus/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add nekzus-npm-sentinel-mcp --command npx --arg -y --arg @nekzus/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  nekzus-npm-sentinel-mcp:
    command: "npx"
    args: ["-y", "@nekzus/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "nekzus-npm-sentinel-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@nekzus/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 −3
- Dependency health: 0.81 → 0.00 ▼ functional
2 Aug 26 +16
- Malware scan: unverified → pass ▲ security
31 Jul 26 +27
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 0
- Package version: 1.25.2 → 1.26.0-alpha.1 functional
29 Jul 26 0
- Package version: 1.24.1 → 1.25.2 functional
- Package version: 1.24.1 → 1.25.0 functional
- Package version: 1.23.0 → 1.25.0-alpha.1 functional
28 Jul 26 −35
- Known CVEs: partial → pass ▲ security
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: partial → 0.81 functional
- Package version: 1.23.0 → 1.24.1 functional
- Package version: 1.23.0 → 1.24.0 functional
27 Jul 26 +64
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
26 Jul 26 12

First indexed and scored.

Show 5 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@nekzus/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: Nekzus/npm-sentinel-mcp
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/Nekzus/npm-sentinel-mcp/.github/workflows/publish.yml@refs/heads/main
Rekor log index:: 2298303353
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:804e9e5b2c574f1bba69aee2cfa3396d94033441d55cf267e7d97c4c8e42e656e7d50089436ad149adff20526d787d818983e184205929cc896562882
Discovery method:: attestation_endpoint

Dependencies 10 packages

10 packages in the resolved dependency tree · 10 deprecated · 3 stale.

MCP tools — 19 exposed · ~964 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

npmAlternatives ~47

Find alternative packages with similar functionality

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to find alternatives for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmChangelogAnalysis ~52

Analyze changelog and release history of packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to analyze changelogs for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmCompare ~47

Compare multiple NPM packages based on various metrics

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to compare

Name	Type	Req	Description
message	string	—	—
queryPackages	array	—	—
results	array	—	—

No examples provided.

npmDeprecated ~46

Check if packages are deprecated

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to check for deprecation

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmDeps ~50

Analyze dependencies and devDependencies of an NPM package

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to analyze dependencies for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmLatest ~53

Get the latest version and changelog of an NPM package

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get latest versions for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmLicenseCompatibility ~48

Check license compatibility between multiple packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to check for license compatibility

Name	Type	Req	Description
compatibility	object	—	—
licenseDetails	array	—	—
packagesAnalyzed	array	—	—

No examples provided.

npmMaintainers ~50

Get maintainers information for NPM packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get maintainers for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmMaintenance ~42

Analyze package maintenance metrics

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to analyze

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmPackageReadme ~52

Get the README content for NPM packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get READMEs for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmQuality ~42

Analyze package quality metrics

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to analyze

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmRepoStats ~49

Get repository statistics for NPM packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get repository stats for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmScore ~53

Get consolidated package score based on quality, maintenance, and popularity metrics

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get scores for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmSearch ~62

Search for NPM packages with optional limit

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
limit	number	—	Maximum number of results to return (default: 10)
query	string	yes	Search query for packages

Name	Type	Req	Description
limitUsed	number	—	—
message	string	—	—
query	string	—	—
results	array	—	—
resultsCount	number	—	—
totalResults	number	—	—

No examples provided.

npmSize ~50

Get package size information including dependencies and bundle size

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get size information for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmTrends ~74

Get download trends and popularity metrics for packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get trends for
period	string	—	Time period for trends. Options: "last-week", "last-month", "last-year"

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmTypes ~50

Check TypeScript types availability and version for a package

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to check types for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmVersions ~49

Get all available versions of an NPM package

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to get versions for

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

npmVulnerabilities ~48

Check for known vulnerabilities in packages

Input Output Examples

Name	Type	Req	Description
ignoreCache	boolean	—	Force a fresh lookup, ignoring the cache
packages	array	yes	List of package names to check for vulnerabilities

Name	Type	Req	Description
message	string	—	—
results	array	—	—
summary	—	—	—

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug

Day	Score
26 Jul	12
27 Jul	76
28 Jul	41
29 Jul	41
30 Jul	41
31 Jul	68
1 Aug	68
2 Aug	84
3 Aug	81