# io.github.YawLabs/npmjs-mcp (npm · @yawlabs/npmjs-mcp)

npm registry MCP server — package intelligence, security audits, dependency analysis

- Trust score: 68/100 (medium)
- Change this week: −7
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@yawlabs/npmjs-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/yawlabs-npmjs-mcp/yawlabs-npmjs-mcp.md), [page](https://verifymcp.io/servers/yawlabs-npmjs-mcp/yawlabs-npmjs-mcp)

## Channel facts

- Registry: `npm`
- Package: `@yawlabs/npmjs-mcp`
- Version: `0.12.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 5024 tokens (~78/item across 64 items; 64 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add yawlabs-npmjs-mcp -- npx -y @yawlabs/npmjs-mcp
```

### Codex

```bash
codex mcp add yawlabs-npmjs-mcp -- npx -y @yawlabs/npmjs-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yawlabs-npmjs-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@yawlabs/npmjs-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add yawlabs-npmjs-mcp --command npx --arg -y --arg @yawlabs/npmjs-mcp
```

### Hermes

```yaml
mcp_servers:
  yawlabs-npmjs-mcp:
    command: "npx"
    args: ["-y", "@yawlabs/npmjs-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "yawlabs-npmjs-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@yawlabs/npmjs-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 67, +18)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Stability: unverified → 0.20

### 2026-08-01 (score 49, −8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 57, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 75, +34)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: excellent

### 2026-07-26 (score 41)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (64)

### `npm_search` (~150 tokens)

Search the npm registry for packages. Supports text search and qualifiers like 'keywords:mcp', 'author:user', 'maintainer:user', 'scope:org', 'not:insecure', 'is:unstable'.

Input parameters:

- `from` (number): Offset for pagination
- `maintenance` (number): Weight for maintenance score (0-1)
- `popularity` (number): Weight for popularity score (0-1)
- `quality` (number): Weight for quality score (0-1)
- `query` (string, required): Search text. Supports qualifiers: keywords:x, author:x, maintainer:x, scope:x
- `size` (number): Number of results (default 20, max 250)

### `npm_package` (~64 tokens)

Get package metadata — description, dist-tags, latest version, maintainers, license, repository, keywords. Does not include per-version details (use npm_version for that).

Input parameters:

- `name` (string, required): Package name (e.g. 'express' or '@anthropic-ai/sdk')

### `npm_version` (~57 tokens)

Get detailed metadata for a specific version — dependencies, dist info, file count, size, deprecation status.

Input parameters:

- `name` (string, required): Package name
- `version` (string): Semver version or dist-tag (default: 'latest')

### `npm_versions` (~75 tokens)

List published versions of a package with their publish dates, ordered newest first. Returns up to `limit` versions (default 50). Set limit=0 to return all.

Input parameters:

- `limit` (number): Max versions to return, newest first (default 50, 0 = all)
- `name` (string, required): Package name

### `npm_readme` (~26 tokens)

Get the README content of a package.

Input parameters:

- `name` (string, required): Package name

### `npm_dist_tags` (~33 tokens)

Get dist-tags for a package (latest, next, beta, etc).

Input parameters:

- `name` (string, required): Package name

### `npm_types` (~81 tokens)

Check TypeScript type support for a package — whether it ships built-in types (types/typings field) or has a DefinitelyTyped companion (@types/* package).

Input parameters:

- `name` (string, required): Package name (e.g. 'express' or '@anthropic-ai/sdk')
- `version` (string): Semver version or dist-tag (default: 'latest')

### `npm_dependencies` (~58 tokens)

Get the dependency lists for a specific package version — production deps, devDeps, peerDeps, and optionalDeps.

Input parameters:

- `name` (string, required): Package name
- `version` (string): Semver version or dist-tag (default: 'latest')

### `npm_dep_tree` (~96 tokens)

Resolve the production dependency tree for a package version (up to a configurable depth). Shows the full transitive dependency graph with versions.

Input parameters:

- `depth` (number): Max tree depth where the root counts as level 1 (default 3 = root + 2 transitive levels, max 5)
- `name` (string, required): Package name
- `version` (string): Semver version or dist-tag (default: 'latest')

### `npm_license_check` (~149 tokens)

Check the license of a package and its direct production dependencies. Flags missing or non-standard licenses. Matches single SPDX license identifiers case-insensitively (so 'mit' and 'MIT' both match). SPDX expressions like '(MIT OR Apache-2.0)' are NOT decomposed — they are flagged unless added to `allowed` verbatim.

Input parameters:

- `allowed` (array): SPDX license identifiers to treat as allowed (default: MIT, ISC, BSD-2-Clause, BSD-3-Clause, Apache-2.0, 0BSD, Unlicense)
- `name` (string, required): Package name
- `version` (string): Semver version or dist-tag (default: 'latest')

### `npm_downloads` (~103 tokens)

Get total download count for a package over a period (last-day, last-week, last-month, last-year, or a custom date range like 2025-01-01:2025-12-31).

Input parameters:

- `name` (string, required): Package name
- `period` (string): Period: 'last-day', 'last-week', 'last-month', 'last-year', or 'YYYY-MM-DD:YYYY-MM-DD' (default: 'last-week')

### `npm_downloads_range` (~72 tokens)

Get daily download counts for a package over a period. Returns per-day breakdown.

Input parameters:

- `name` (string, required): Package name
- `period` (string): Period: 'last-week', 'last-month', 'last-year', or 'YYYY-MM-DD:YYYY-MM-DD' (default: 'last-month')

### `npm_downloads_bulk` (~82 tokens)

Compare download counts for multiple packages over a period. Up to 128 packages. Scoped packages (@scope/name) are NOT supported by the bulk endpoint — call npm_downloads separately for each scoped package.

Input parameters:

- `packages` (array, required): Array of package names to compare (unscoped only)
- `period` (string): Period (default: 'last-week')

### `npm_version_downloads` (~62 tokens)

Get download counts broken down by version for the last week. Shows version adoption.

Input parameters:

- `name` (string, required): Package name
- `period` (string): Period: 'last-day', 'last-week', 'last-month' (default: 'last-week')

### `npm_audit` (~88 tokens)

Quick vulnerability check for specific packages and versions using the bulk advisory API. Returns matching advisories with severity, CVEs, and patched versions. For richer detail (CVSS scores, CWEs, fix recommendations), use npm_audit_deep instead.

Input parameters:

- `packages` (object, required): Object mapping package names to arrays of version strings, e.g. {"lodash": ["4.17.20"]}

### `npm_audit_deep` (~140 tokens)

Full security audit on a dependency set — returns detailed advisories with CVSS scores, CWEs, affected version ranges, fix recommendations, and full vulnerability metadata. Uses the npm audit v1 endpoint which provides richer detail than the bulk advisory API (npm_audit). Requires you to provide the dependency map (use npm_dependencies to get it first).

Input parameters:

- `dependencies` (object, required): Dependencies to audit as { "package": "version" }, e.g. { "express": "4.17.1" }
- `name` (string, required): Project name
- `version` (string): Project version (default: '1.0.0')

### `npm_signing_keys` (~26 tokens)

Get the npm registry's ECDSA signing keys used to verify package signatures.

### `npm_compare` (~59 tokens)

Compare 2-5 packages side-by-side — downloads, version, license, maintainers, size, last publish, and security status. Great for 'should I use X or Y?' decisions.

Input parameters:

- `packages` (array, required): Package names to compare

### `npm_health` (~40 tokens)

Assess the health of a package — maintenance activity, download trend, security status, deprecation, and documentation quality.

Input parameters:

- `name` (string, required): Package name

### `npm_maintainers` (~31 tokens)

Get current maintainers and their publish history for a package.

Input parameters:

- `name` (string, required): Package name

### `npm_release_frequency` (~56 tokens)

Analyze the release cadence of a package — publish timeline, gaps, and whether the project is actively maintained.

Input parameters:

- `limit` (number): Number of recent releases to analyze (default 20)
- `name` (string, required): Package name

### `npm_registry_stats` (~51 tokens)

Get total npm-wide download counts for a period. Shows overall registry activity.

Input parameters:

- `period` (string): Period: 'last-day', 'last-week', 'last-month' (default: 'last-week')

### `npm_recent_changes` (~61 tokens)

Get the most recent package publishes/updates from the npm registry via the CouchDB changes feed. Note: uses replicate.npmjs.com which may have intermittent availability.

Input parameters:

- `limit` (number): Number of recent changes (default 25, max 100)

### `npm_ops_playbook` (~66 tokens)

Return canonical recipes for common npm operations — which MCP tool to call for which op, CLI fallbacks when the MCP server can't handle something, and message format guidance. Call this FIRST when you're not sure how to do an npm operation. Prevents reinventing approaches that don't work.

### `npm_whoami` (~39 tokens)

Check the currently authenticated npm user. Verifies the NPM_TOKEN is valid and returns the associated username. Essential for debugging auth issues before publishing.

### `npm_profile` (~44 tokens)

Get the authenticated user's npm profile — name, email, 2FA status, creation date. Useful for checking whether 2FA is enabled (which affects token requirements for publishing).

### `npm_tokens` (~101 tokens)

List all access tokens for the authenticated npm user. Shows token type, creation date, CIDR restrictions, and read-only status. Critical for finding reusable automation/granular tokens that cover your org scope — avoids the common mistake of creating duplicate tokens or using publish tokens in CI (which still require OTP).

Input parameters:

- `page` (number): Page number for pagination (default: 0)
- `perPage` (number): Results per page (default: 25)

### `npm_verify_token` (~64 tokens)

Verify the NPM_TOKEN and surface its capabilities — username, 2FA status, and whether writes are likely to succeed. Call this FIRST when debugging any write failure to rule out auth issues before trying other fixes. Faster than running writes and interpreting 401/403 errors.

### `npm_user_packages` (~42 tokens)

List all packages published by a specific npm user. Shows package names and the user's access level for each. Requires authentication.

Input parameters:

- `username` (string, required): npm username

### `npm_org_members` (~46 tokens)

List all members of an npm organization with their roles (owner, admin, developer). Requires authentication as an org member.

Input parameters:

- `org` (string, required): Organization name (without @ prefix)

### `npm_org_packages` (~47 tokens)

List all packages accessible to an npm organization with their access levels. Shows what the org owns or has been granted access to.

Input parameters:

- `org` (string, required): Organization name (without @ prefix)

### `npm_org_teams` (~38 tokens)

List all teams within an npm organization. Requires authentication as an org member.

Input parameters:

- `org` (string, required): Organization name (without @ prefix)

### `npm_team_packages` (~57 tokens)

List all packages a specific team has access to and their permission levels (read-only or read-write). Useful for auditing team permissions.

Input parameters:

- `org` (string, required): Organization name (without @ prefix)
- `team` (string, required): Team name

### `npm_team_members` (~75 tokens)

List all members of a team with their roles (e.g. 'developer'). Complements npm_team_member_add and npm_team_member_remove — use this to audit who is currently on the team before adding or removing members.

Input parameters:

- `org` (string, required): Organization name (without @ prefix)
- `team` (string, required): Team name

### `npm_collaborators` (~69 tokens)

Get all users who have access to a package and their permission levels (read-only, read-write). Useful for verifying who can publish to a package before setting up CI/CD.

Input parameters:

- `name` (string, required): Package name (e.g. 'express' or '@yawlabs/npmjs-mcp')

### `npm_package_access` (~90 tokens)

Get package access settings — visibility (public/private), whether publish requires 2FA, and whether automation tokens can bypass 2FA. Critical for understanding why CI publishing fails: if publish_requires_tfa is true but automation_token_overrides_tfa is false, automation tokens cannot publish.

Input parameters:

- `name` (string, required): Package name (e.g. 'express' or '@yawlabs/npmjs-mcp')

### `npm_provenance` (~127 tokens)

Retrieve Sigstore attestations for a specific package version. Shows SLSA provenance (which CI built it, from which repo/commit) and publish attestations. NOTE: this tool RETRIEVES attestations from the registry -- it does NOT perform cryptographic signature, certificate-chain, or Rekor transparency-log verification. Use a dedicated Sigstore client to cryptographically verify the bundles.

Input parameters:

- `name` (string, required): Package name (e.g. '@anthropic-ai/sdk')
- `version` (string, required): Exact semver version (e.g. '1.0.0')

### `npm_trusted_publishers` (~79 tokens)

List trusted publishing configurations for a package. Shows OIDC trust relationships with CI/CD providers (GitHub Actions, GitLab CI, CircleCI) that allow tokenless publishing. Requires authentication with write access to the package.

Input parameters:

- `name` (string, required): Package name (e.g. 'express' or '@yawlabs/npmjs-mcp')

### `npm_check_auth` (~98 tokens)

Quick auth health check — returns structured data about npm auth status, token capability, and whether headless (CI/agent) publishing is possible. Run this BEFORE attempting any publish operation. Returns canPublishHeadless boolean and a clear recommendation.

MCP servers are called by AI agents which CANNOT open browsers or enter OTP codes. This tool detects that and provides the exact terminal command for the human to run instead of suggesting unworkable retries.

### `npm_publish_preflight` (~180 tokens)

Comprehensive pre-publish validation — run before publishing ANY npm package. Returns an actionable checklist with pass/fail/warn for each item.

ASSUMES NON-INTERACTIVE CONTEXT BY DEFAULT because MCP servers are called by AI agents that:
\- CANNOT open browsers (so --auth-type=web is useless)
\- CANNOT enter OTP codes
\- CANNOT retry with 2FA — this is a hand-off to the human

Checks: auth token validity, 2FA requirements, token type inference, org-level token reuse, package name availability, maintainer access, scoped package settings.

When issues are found, returns structured actions with exact commands for the HUMAN to run in their terminal — never suggests actions an agent cannot perform.

Input parameters:

- `name` (string, required): Package name to publish (e.g. '@yawlabs/npmjs-mcp')

### `npm_deprecate` (~223 tokens)

Deprecate a package or specific versions. Shows a warning message on install. Uses the HTTP API with NPM_TOKEN, bypassing the CLI auth friction that causes 422 errors on accounts with 2FA. Registry hard limit: deprecation messages must be <= 1024 characters. If the registry 422s, first verify the semver range matches at least one published version (npm_versions) — range/version mismatches are the most common cause, not message format.

Input parameters:

- `message` (string, required): Deprecation message. Use npm_undeprecate to clear.
- `name` (string, required): Package name (e.g. '@yawlabs/spend')
- `versionRange` (string): Semver range. Omit to deprecate ALL versions. Example: '<1.0.0' or '0.3.x'. Standard semver applies — bare integers are x-ranges (e.g. '0' means '0.x.x', not exact version 0). For a single version us…

### `npm_undeprecate` (~70 tokens)

Clear the deprecation message from a package or specific versions. Equivalent to npm_deprecate with an empty message but more explicit about intent.

Input parameters:

- `name` (string, required): Package name
- `versionRange` (string): Semver range. Omit to undeprecate ALL versions.

### `npm_unpublish_version` (~199 tokens)

Unpublish a specific version of a package. IRREVERSIBLE: once unpublished, the version cannot be re-published and will be blocked for 72 hours. Only works within 72 hours of the original publish for most packages. Requires explicit confirm: true to prevent accidents. Follows the npm CLI flow (mutate packument + delete tarball). For full-package unpublish use npm_unpublish_package. Dist-tag handling: any dist-tag that pointed at the unpublished version is removed. Only `latest` is auto-reassigned (to the highest remaining stable version). Other tags like `next`/`beta` are left unset — reassign them explicitly with npm_dist_tag_set if needed.

Input parameters:

- `confirm` (boolean, required): Must be literally true. Guards against accidental unpublish.
- `name` (string, required): Package name
- `version` (string, required): Specific version to unpublish (e.g. '1.2.3')

### `npm_unpublish_package` (~93 tokens)

Unpublish an ENTIRE package (all versions). DELETE /{pkg}/-rev/{rev}. IRREVERSIBLE: the name is blocked for 72 hours and cannot be re-published. For single-version unpublish prefer npm_unpublish_version. Requires confirm: true.

Input parameters:

- `confirm` (boolean, required): Must be literally true. Guards against accidental full unpublish.
- `name` (string, required): Package name

### `npm_dist_tag_set` (~97 tokens)

Point a dist-tag (e.g. 'latest', 'beta', 'next') at a specific version. Common uses: promote a beta to latest, roll back latest to a prior version, maintain separate channels.

Input parameters:

- `name` (string, required): Package name
- `tag` (string, required): Dist-tag name (e.g. 'latest', 'beta', 'next')
- `version` (string, required): Version the tag should point to

### `npm_dist_tag_remove` (~52 tokens)

Remove a dist-tag from a package. The 'latest' tag cannot be removed, only reassigned.

Input parameters:

- `name` (string, required): Package name
- `tag` (string, required): Dist-tag name to remove

### `npm_owner_add` (~78 tokens)

Add a user as a maintainer of a package. They will have publish and write permissions. Resolves the user's email via /-/user/ (no need to supply it). Use npm_collaborators to verify before adding.

Input parameters:

- `name` (string, required): Package name
- `username` (string, required): npm username to add as maintainer

### `npm_owner_remove` (~57 tokens)

Remove a user from a package's maintainer list. Refuses if it would leave the package with zero maintainers (lockout prevention).

Input parameters:

- `name` (string, required): Package name
- `username` (string, required): npm username to remove

### `npm_access_set` (~95 tokens)

Set package access level: 'public' or 'restricted' (private). 'private' is accepted as an alias for 'restricted' for ergonomics -- both map to the registry wire value 'restricted'. Unscoped packages are always public. Restricted access requires a paid npm account.

Input parameters:

- `access` (string, required): Access level ('private' maps to 'restricted' on the wire)
- `name` (string, required): Package name

### `npm_access_set_mfa` (~66 tokens)

Configure 2FA requirement for publishing: 'none' (off), 'publish' (2FA required), 'automation' (2FA required but automation tokens can bypass).

Input parameters:

- `level` (string, required): MFA level for publish
- `name` (string, required): Package name

### `npm_team_grant` (~119 tokens)

Grant a team read-only or read-write permission on a package. Scope and team are passed as @scope:team (e.g. '@yawlabs:devs'). Requires org admin or team admin.

Input parameters:

- `package` (string, required): Package name. Field is named 'package' to match the npm CLI (diverges from 'name' used elsewhere in this server).
- `permissions` (string, required): Permission level
- `team` (string, required): Team in the form '@scope:team' (e.g. '@yawlabs:devs')

### `npm_team_revoke` (~90 tokens)

Revoke a team's access to a package. Team is passed as '@scope:team'. Does not delete the team itself — use npm_team_delete for that.

Input parameters:

- `package` (string, required): Package name. Field is named 'package' to match the npm CLI (diverges from 'name' used elsewhere in this server).
- `team` (string, required): Team in the form '@scope:team'

### `npm_team_create` (~50 tokens)

Create a team inside an organization. Team is passed as '@scope:team'.

Input parameters:

- `description` (string): Optional team description
- `team` (string, required): Team in the form '@scope:team'

### `npm_team_delete` (~105 tokens)

Delete a team. Team is passed as '@scope:team'. Revokes all package permissions that team held, and team memberships are also removed. Requires confirm: true — this removes the team and all its package grants in one call. List the team's current grants with npm_team_packages first if you need to preserve them.

Input parameters:

- `confirm` (boolean, required): Must be literally true. Guards against accidental team deletion.
- `team` (string, required): Team in the form '@scope:team'

### `npm_team_member_add` (~56 tokens)

Add a user to a team. Team is '@scope:team'. User must already be in the org.

Input parameters:

- `team` (string, required): Team in the form '@scope:team'
- `user` (string, required): npm username

### `npm_team_member_remove` (~54 tokens)

Remove a user from a team. Team is '@scope:team'. User remains in the org.

Input parameters:

- `team` (string, required): Team in the form '@scope:team'
- `user` (string, required): npm username

### `npm_org_member_set` (~104 tokens)

Add a user to an org or change their role. Roles: 'developer', 'admin', 'owner'. If user is already in the org, updates the role. Omit role to keep existing role.

Input parameters:

- `confirm` (boolean, required): Must be literally true. Guards against accidental org membership changes.
- `org` (string, required): Organization name (with or without leading @)
- `role` (string): Role to assign
- `user` (string, required): npm username

### `npm_org_member_remove` (~76 tokens)

Remove a user from an org. Their team memberships in that org are also removed. Requires confirm: true — team memberships cascade and cannot be selectively preserved.

Input parameters:

- `confirm` (boolean, required): Must be literally true. Guards against accidental member removal.
- `org` (string, required): Organization name
- `user` (string, required): npm username

### `npm_token_revoke` (~112 tokens)

Revoke an access token by its key (UUID from npm_tokens). Requires confirm: true. Revoking the token currently in use by NPM_TOKEN will break the next call. Creating tokens is NOT exposed because the endpoint requires the user password — create via https://www.npmjs.com/settings/~/tokens instead.

Input parameters:

- `confirm` (boolean, required): Must be literally true. Guards against revoking the token you're authenticating with.
- `tokenKey` (string, required): Token key (UUID shown by npm_tokens)

### `npm_hook_add` (~127 tokens)

Create a registry webhook. Target is 'pkg' or '@scope/pkg' for a package, '@scope' for a scope, or '~user' for a user's packages. Endpoint is the HTTPS URL to POST events to; secret is used to HMAC-sign payloads. The secret is never echoed back in tool responses.

Input parameters:

- `endpoint` (string, required): HTTPS URL that will receive POST events
- `secret` (string, required): Secret used to HMAC-sign webhook payloads
- `target` (string, required): Hook target: 'pkg', '@scope/pkg', '@scope', or '~user'

### `npm_hook_list` (~56 tokens)

List webhooks. Optionally filter by package name. Secrets are redacted from responses.

Input parameters:

- `limit` (integer): Max results
- `offset` (integer): Pagination offset
- `package` (string): Filter by package name

### `npm_hook_get` (~42 tokens)

Get a single webhook by its ID. The stored secret is redacted from the response.

Input parameters:

- `id` (string, required): Hook ID (UUID from npm_hook_list)

### `npm_hook_update` (~57 tokens)

Update a webhook's endpoint and/or secret. The returned hook object has the secret redacted.

Input parameters:

- `endpoint` (string, required): New HTTPS URL
- `id` (string, required): Hook ID
- `secret` (string, required): New signing secret

### `npm_hook_remove` (~24 tokens)

Delete a webhook by ID.

Input parameters:

- `id` (string, required): Hook ID

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/yawlabs-npmjs-mcp/yawlabs-npmjs-mcp#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 67
- 2026-08-01: 49
- 2026-07-31: 57
- 2026-07-29: 75
- 2026-07-28: 75
- 2026-07-27: 75
- 2026-07-26: 41

## Links

- npm package: https://www.npmjs.com/package/@yawlabs/npmjs-mcp
- Socket report: https://socket.dev/npm/package/@yawlabs/npmjs-mcp
- Changelog RSS feed: https://verifymcp.io/servers/yawlabs-npmjs-mcp/yawlabs-npmjs-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/yawlabs-npmjs-mcp/yawlabs-npmjs-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/yawlabs-npmjs-mcp/yawlabs-npmjs-mcp