Skip to content
Agentmart
Submit a tool

Best MCP servers for npm

We found 86 MCP servers for npm in the catalog; these are the 15 that rank highest. The order comes from our rank, which weighs adoption, freshness, documentation and publisher identity. Nobody can pay for a place on this list. stalemap, SkillTotal and Pare npm lead it. SkillTotal and Kenwea Notary are published by the company that makes them. Pare npm has the most GitHub stars here (139). 15 of the 15 had activity in the last 30 days. Remote servers need no local install; local ones run on your machine and can reach local files. Each entry lists why it made the list and links to its install page.

Updated Oct 26, 2026 · Built from catalog data; how we rank and grade

Top 15 of 86

  1. 1
    stalemap

    Umair

    Tells coding agents which npm dependencies changed after their training cutoff, and what changed.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 100Last active Oct 21, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  2. 2
    SkillTotal

    skilltotal.aiOfficial

    Deterministic security scan of MCP servers, agent skills and npm/PyPI packages.

    • Published by the vendor
    • Most weekly downloads here (1.7K)
    • Active in the last 30 days

    ★ 15↓ 1.7K/wkLast active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  3. 3
    Pare npm

    Dave-London

    Pare npm ג€” Structured npm/pnpm operations (install, audit, outdated, list, run) as typed JSON.

    • Most GitHub stars here (139)
    • Active in the last 30 days
    • Open source (MIT)

    ★ 139↓ 63/wkLast active Oct 19, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  4. 4
    Commit — Supply Chain Risk Scoring

    piiiico

    Supply chain risk scoring for npm, PyPI, Cargo, and Go.

    • Runs locally or as a remote server
    • Active in the last 30 days
    • Open source (MIT)

    ★ 8Last active Oct 6, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2

  5. 5
    lurq

    jadenryu

    Verify npm packages before your AI agent installs them: hallucinations, advisories, API drift.

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (MIT)

    ★ 8Last active Oct 23, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  6. 6
    Slopsquat Scanner

    GuardBee

    Checks declared npm/PyPI dependencies against real registries to catch slopsquatting

    • Active in the last 30 days
    • Open source (MIT)

    ★ 1↓ 603/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  7. 7
    Dependency Auditor

    GuardBee

    CVE scanning for npm/pip/cargo dependencies via OSV

    • Active in the last 30 days
    • Open source (MIT)

    ★ 1↓ 647/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  8. 8
    Pkgtruth

    hxckya

    Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 4Last active Oct 19, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  9. 9
    NPMScan

    salemalem

    Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 24, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  10. 10
    Safeinstall

    Mickdownunder

    Local-first supply-chain security gate for npm/pnpm/bun: typosquat, release age, provenance checks

    • Active in the last 30 days
    • Open source (MIT)

    ★ 3Last active Oct 1, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  11. 11
    npm Registry MCP Server

    YawLabs

    npm registry MCP server — package intelligence, security audits, dependency analysis

    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 15, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  12. 12
    Vigía

    vigia.coredls.cloud

    What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (AGPL-3.0)

    ★ 1Last active Oct 22, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  13. 13
    Kenwea Notary

    www.kenwea.comOfficial

    Signed, traced record of what an npm package or file attempts when run, network included.

    • Published by the vendor
    • Remote server, no local install
    • Active in the last 30 days

    ★ 1Last active Oct 21, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  14. 14
    Presend dependency checks

    presendapp

    Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (MIT)

    ★ 1Last active Oct 17, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  15. 15
    Presend MCP Server

    presendapp

    Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (MIT)

    ★ 1Last active Oct 17, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

Related