Nekzus Npm Sentinel MCP server

What it does

NPM Sentinel MCP is a Model Context Protocol server that exposes 19 tools for querying NPM package metadata, security vulnerabilities, dependency trees, quality scores, and download trends. It targets developers and AI agents that need programmatic, real-time analysis of NPM packages within MCP-compatible clients such as Claude Desktop, Cursor, or Smithery.

• Scan a list of NPM packages for known vulnerabilities using Google deps.dev and OSV.dev advisories before adding them to a project.
• Compare multiple packages side-by-side on size, download trends, license compatibility, and maintenance scores to inform a dependency decision.
• Retrieve full dependency trees and deprecation status for packages already in use to audit transitive risk.

Tools this server exposes

Tool	Does
npmLatest	Returns the latest version, release date, SRI integrity hash, and dist-tags for one or more packages.
npmVersions	Returns full version history with release dates and deprecation statuses for one or more packages.
npmDeps	Returns direct dependencies and the full transitive dependency graph via deps.dev.
npmTypes	Checks whether a package ships native TypeScript declarations or relies on a DefinitelyTyped @types package.
npmSize	Returns bundle size, minified size, and gzip impact for one or more packages.
npmVulnerabilities	Scans packages and their transitive dependencies for known vulnerabilities via deps.dev and OSV.dev.
npmTrends	Returns historical download statistics for a configurable period (last-week, last-month, last-year).
npmCompare	Produces a side-by-side metric comparison across multiple packages.
npmMaintainers	Lists maintainers, public emails, and publishing activity for one or more packages.
npmScore	Returns a consolidated score combining quality, popularity, maintenance, and OpenSSF Scorecard data.
npmPackageReadme	Fetches the raw README markdown content for one or more packages from the NPM registry.
npmSearch	Searches the NPM registry by query string and returns packages with scores, publisher, and keywords.
npmLicenseCompatibility	Analyzes and reports license compatibility across a set of packages.
npmRepoStats	Returns GitHub repository stats (stars, forks, open issues) and OpenSSF Scorecard checks for one or more packages.
npmDeprecated	Detects deprecation status on a package and its recursive sub-dependencies.
npmChangelogAnalysis	Extracts release notes and GitHub release history for one or more packages.
npmAlternatives	Suggests functional alternative packages while filtering out ecosystem plugins and extensions.
npmQuality	Returns a code quality score (0–1) for one or more packages.
npmMaintenance	Returns a maintenance activity score (0–1) for one or more packages.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.