npm Registry MCP Server
Connects Claude directly to the npm registry for real-time package intelligence. You get security audits, dependency tree analysis, and package metadata without leaving your conversation. Reach for this when you're evaluating libraries, investigating vulnerabilities in your dependency chain, or need quick stats on download counts and maintenance status. Saves you from bouncing between npmjs.com tabs and lets you ask questions like "what are the security issues in this package" or "show me the dependencies for express" inline with your development workflow.
- GitHub stars
- 5
- tools
- 64
- transport
- STDIO
- last updated
- Nov 12, 2026
Tools
64 toolsPublic tool metadata for what this MCP can expose to an agent.
npm_searchSearch the npm registry with qualifiers (keywords, author, scope).
Search the npm registry with qualifiers (keywords, author, scope).
No parameter schema in public metadata yet.
npm_packageMetadata: description, dist-tags, maintainers, license, repository.
Metadata: description, dist-tags, maintainers, license, repository.
No parameter schema in public metadata yet.
npm_versionDetailed metadata for a specific version.
Detailed metadata for a specific version.
No parameter schema in public metadata yet.
npm_versionsAll published versions with dates.
All published versions with dates.
No parameter schema in public metadata yet.
npm_readmeREADME content.
README content.
No parameter schema in public metadata yet.
npm_dist_tagsDist-tags (latest, next, beta, etc).
Dist-tags (latest, next, beta, etc).
No parameter schema in public metadata yet.
npm_typesTypeScript type support (built-in types or `@types/*`).
TypeScript type support (built-in types or `@types/*`).
No parameter schema in public metadata yet.
npm_dependenciesDependency lists (prod, dev, peer, optional).
Dependency lists (prod, dev, peer, optional).
No parameter schema in public metadata yet.
npm_dep_treeTransitive dependency tree (configurable depth).
Transitive dependency tree (configurable depth).
No parameter schema in public metadata yet.
npm_license_checkLicense audit of a package and its direct deps.
License audit of a package and its direct deps.
No parameter schema in public metadata yet.
npm_downloadsTotal download count for a period.
Total download count for a period.
No parameter schema in public metadata yet.
npm_downloads_rangeDaily download breakdown.
Daily download breakdown.
No parameter schema in public metadata yet.
npm_downloads_bulkCompare downloads for up to 128 packages.
Compare downloads for up to 128 packages.
No parameter schema in public metadata yet.
npm_version_downloadsPer-version download counts.
Per-version download counts.
No parameter schema in public metadata yet.
npm_auditCheck packages for known vulnerabilities.
Check packages for known vulnerabilities.
No parameter schema in public metadata yet.
npm_audit_deepFull audit with CVSS scores, CWEs, fix recommendations.
Full audit with CVSS scores, CWEs, fix recommendations.
No parameter schema in public metadata yet.
npm_signing_keysRegistry ECDSA signing keys.
Registry ECDSA signing keys.
No parameter schema in public metadata yet.
npm_compareCompare 2–5 packages side-by-side.
Compare 2–5 packages side-by-side.
No parameter schema in public metadata yet.
npm_healthMaintenance, downloads, security, deprecation summary.
Maintenance, downloads, security, deprecation summary.
No parameter schema in public metadata yet.
npm_maintainersMaintainers and publish history.
Maintainers and publish history.
No parameter schema in public metadata yet.
npm_release_frequencyRelease cadence and gaps.
Release cadence and gaps.
No parameter schema in public metadata yet.
npm_registry_statsTotal npm-wide download counts.
Total npm-wide download counts.
No parameter schema in public metadata yet.
npm_recent_changesRecent publishes from the CouchDB changes feed.
Recent publishes from the CouchDB changes feed.
No parameter schema in public metadata yet.
npm_ops_playbookCanonical recipes for npm operations. Call this first when unsure which tool to use.
Canonical recipes for npm operations. Call this first when unsure which tool to use.
No parameter schema in public metadata yet.
npm_provenanceSigstore attestations (SLSA, publish).
Sigstore attestations (SLSA, publish).
No parameter schema in public metadata yet.
npm_trusted_publishersOIDC trust relationships with CI/CD providers.
OIDC trust relationships with CI/CD providers.
No parameter schema in public metadata yet.
npm_whoamiAuthenticated user.
Authenticated user.
No parameter schema in public metadata yet.
npm_profileProfile, email, 2FA status.
Profile, email, 2FA status.
No parameter schema in public metadata yet.
npm_tokensList access tokens.
List access tokens.
No parameter schema in public metadata yet.
npm_verify_tokenOne-call capability check. Call this first when debugging write failures.
One-call capability check. Call this first when debugging write failures.
No parameter schema in public metadata yet.
npm_user_packagesPackages published by a user.
Packages published by a user.
No parameter schema in public metadata yet.
npm_collaboratorsPackage collaborators and permissions.
Package collaborators and permissions.
No parameter schema in public metadata yet.
npm_package_accessPackage access settings.
Package access settings.
No parameter schema in public metadata yet.
npm_org_membersOrg members and roles.
Org members and roles.
No parameter schema in public metadata yet.
npm_org_packagesOrg packages.
Org packages.
No parameter schema in public metadata yet.
npm_org_teamsOrg teams.
Org teams.
No parameter schema in public metadata yet.
npm_team_packagesTeam package permissions.
Team package permissions.
No parameter schema in public metadata yet.
npm_team_membersTeam members and roles.
Team members and roles.
No parameter schema in public metadata yet.
npm_check_authAuth health check with headless publish feasibility.
Auth health check with headless publish feasibility.
No parameter schema in public metadata yet.
npm_publish_preflightPre-publish validation checklist.
Pre-publish validation checklist.
No parameter schema in public metadata yet.
npm_deprecateDeprecate a package or specific versions (enforces the registry's 1024-char message limit; message punctuation is not constrained).
Deprecate a package or specific versions (enforces the registry's 1024-char message limit; message punctuation is not constrained).
No parameter schema in public metadata yet.
npm_undeprecateClear deprecation.
Clear deprecation.
No parameter schema in public metadata yet.
npm_unpublish_versionUnpublish a version. Requires `confirm: true`.
Unpublish a version. Requires `confirm: true`.
No parameter schema in public metadata yet.
npm_unpublish_packageUnpublish an entire package. Requires `confirm: true`.
Unpublish an entire package. Requires `confirm: true`.
No parameter schema in public metadata yet.
npm_dist_tag_setPoint a dist-tag at a version.
Point a dist-tag at a version.
No parameter schema in public metadata yet.
npm_dist_tag_removeRemove a dist-tag (refuses `latest`).
Remove a dist-tag (refuses `latest`).
No parameter schema in public metadata yet.
npm_owner_addAdd a maintainer (resolves user via `/-/user/`).
Add a maintainer (resolves user via `/-/user/`).
No parameter schema in public metadata yet.
npm_owner_removeRemove a maintainer (prevents self-lockout).
Remove a maintainer (prevents self-lockout).
No parameter schema in public metadata yet.
npm_access_setSet public/private/restricted access.
Set public/private/restricted access.
No parameter schema in public metadata yet.
npm_access_set_mfaConfigure 2FA requirement (none/publish/automation).
Configure 2FA requirement (none/publish/automation).
No parameter schema in public metadata yet.
npm_team_grantGrant team permissions on a package.
Grant team permissions on a package.
No parameter schema in public metadata yet.
npm_team_revokeRevoke team permissions on a package.
Revoke team permissions on a package.
No parameter schema in public metadata yet.
npm_team_createCreate a team in an org.
Create a team in an org.
No parameter schema in public metadata yet.
npm_team_deleteDelete a team in an org.
Delete a team in an org.
No parameter schema in public metadata yet.
npm_team_member_addManage team members.
Manage team members.
No parameter schema in public metadata yet.
npm_team_member_removeManage team members.
Manage team members.
No parameter schema in public metadata yet.
npm_org_member_setManage org membership and roles.
Manage org membership and roles.
No parameter schema in public metadata yet.
npm_org_member_removeManage org membership and roles.
Manage org membership and roles.
No parameter schema in public metadata yet.
npm_token_revokeRevoke an access token by key.
Revoke an access token by key.
No parameter schema in public metadata yet.
npm_hook_addRegister a webhook on a package, scope, or user.
Register a webhook on a package, scope, or user.
No parameter schema in public metadata yet.
npm_hook_listList webhooks (optional package filter).
List webhooks (optional package filter).
No parameter schema in public metadata yet.
npm_hook_getFetch a single webhook.
Fetch a single webhook.
No parameter schema in public metadata yet.
npm_hook_updateUpdate endpoint/secret.
Update endpoint/secret.
No parameter schema in public metadata yet.
npm_hook_removeDelete a webhook.
Delete a webhook.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
@yawlabs/npmjs-mcp
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.
Run npm registry operations from Claude Code, Cursor, and any MCP client. 64 tools covering the full registry surface: package intelligence, security audits, dependency analysis, org/team management, and the write ops that normally fight you locally (npm deprecate, npm dist-tag, npm owner, npm unpublish).
Built and maintained by Yaw Labs.
Why this one?
Details
- Repository
- github.com/yawlabs/npmjs-mcp
- Website
- yaw.sh/mcp-servers/npmjs-mcp
- Category
- Security & Pentesting
- Package
@yawlabs/npmjs-mcp- Transport
- STDIO
- Registry
- MCP registry, active
More from yawlabs
Related Security & Pentesting MCP servers
View all
Argusironclawdevs27/argusAutomated web QA via Chrome DevTools MCP — a11y, security, visual, env diff, CI; Aegis redaction.5stars
Service Public Franceonenicolas/mcp-service-publicFrench public services: tax, property, admin, education, healthcare, security, risks, legal texts5stars
Excalidrawdebu-sinha/excalidraw-mcp-serverSecurity-hardened Excalidraw MCP server with auth, rate limiting, and 14 tools3stars
Mcp Filesystemdigital-defiance/ai-capabilities-suiteAdvanced filesystem operations with strict security boundaries for AI agents3stars
Megalinterdownatthebottomofthemolehole/megalinter-mcpMCP server for running Ox Security MegaLinter via mega-linter-runner3stars