# NPMScan

> NPMScan is a threat intelligence platform for the npm ecosystem: package risk analysis, install-script inspection, and a searchable, category-filterable feed of known vulnerabilities and security advisories.

NPMScan also runs a public, read-only **MCP (Model Context Protocol) server** so AI agents can look up npm package
metadata and vulnerabilities directly instead of scraping the site or guessing from a package's README. No API key
required.

## MCP Server (for AI agents)

- [MCP endpoint](https://npmscan.com/api/mcp): Streamable HTTP, JSON-RPC 2.0. Add with `claude mcp add --transport http npmscan https://npmscan.com/api/mcp` or any MCP-compatible client (Claude Code, Claude Desktop, Cursor, ChatGPT Developer Mode).
- [ChatGPT app](https://chatgpt.com/plugins/plugin_asdk_app_6a6a699e6f3481918d5e6034432894f2?q=npm): npmscan is an approved app in the ChatGPT Apps directory — one-click install instead of adding the connector manually.
- [Claude Code plugin](https://github.com/salemalem/npmscan-mcp-plugin): wraps this MCP server with two bundled skills, `dependency-audit` and `package-trust-check`.
- [MCP setup guide](https://npmscan.com/docs/mcp): Connection instructions and config snippets.
- [MCP tools reference](https://npmscan.com/mcp): Input schema plus real request/response examples for all 23 tools (get_package, get_package_version, get_maintainer_profile, search_packages, query_vulnerabilities, batch_query_vulnerabilities, get_latest_advisories, get_cve, analyze_install_script, analyze_transitive_dependencies, check_package_provenance, check_maintainer_changes, check_maintainer_blast_radius, check_license_compliance, diff_dependencies, prioritize_remediation, simulate_dependency_upgrade, suggest_alternative, compare_packages, audit_github_repository, get_remediation_playbook, generate_sbom, enrich_npm_audit).

## Docs

- [Docs home](https://npmscan.com/docs)
- [REST API](https://npmscan.com/api)

## Site

- [Search packages](https://npmscan.com/search)
- [Analyze a dependency tree](https://npmscan.com/analyze)
- [Latest vulnerabilities](https://npmscan.com/latest-vulnerabilities): Filterable by severity, 20 vulnerability categories (XSS, SQL/NoSQL Injection, SSRF, Access Control, Code Injection, and more), and searchable by npm package name or an exact GHSA/CVE ID.
- [Latest vulnerabilities RSS](https://npmscan.com/latest-vulnerabilities/rss.xml): Same feed with severity/category `<category>` tags on every item for filtering in a feed reader.