# Salemalem Npmscan MCP server

Source: https://glimind.com/server/mcp-registry%2Fio.github.salemalem%2Fnpmscan
Registry id: `mcp-registry/io.github.salemalem/npmscan`
Status: live (checked 2026-10-27T03:38:51.941Z)

## Verdict

Salemalem Npmscan MCP server answered 99.95% of Glimind's liveness checks over 30 days, better than 35% of MCP servers, with 932 ms median handshake and 6 outages in 90 days. Its agent-readiness grade is A (96/100) across 23 tools, costing an agent about 9,363 tokens to load. Checked every few minutes; no tool is ever called.

## Measurements (30 days)

| Metric | Value | Better than |
|---|---|---|
| Uptime, 30 days | 99.95% | 35% of MCP servers |
| Median handshake latency | 932 ms | 23% of MCP servers |
| p95 handshake latency | 2965 ms | — |
| Checks in 30 days | 4,939 | — |
| Outages, 90 days | 6 | — |
| Median recovery | 9 min | — |
| Agent-readiness score | 96/100 (A) | 82% of MCP servers |
| Tools | 23 | — |
| Tool-list size for an agent | ~9,363 tokens | 31% of MCP servers |
| Days observed | 29 | — |

## Install

```json
{
  "mcpServers": {
    "salemalem-npmscan-mcp-server": {
      "type": "http",
      "url": "https://npmscan.com/api/mcp"
    }
  }
}
```

Claude Code:

```sh
claude mcp add --transport http salemalem-npmscan-mcp-server https://npmscan.com/api/mcp
```

## Tools (23)

- `analyze_install_script`: Statically scans a package's preinstall/install/postinstall/prepare lifecycle scripts AND the file(s) they reference — fetched directly from the published tarba
- `analyze_transitive_dependencies`: Walk one or more root packages' dependency trees (e.g. a package.json "dependencies" section) up to `maxDepth` levels (default 2, max 3) and check every resolve
- `audit_github_repository`: Audit a GitHub repository's npm dependencies from its URL — no pasted files needed. Fetches package.json plus the first lockfile found (pnpm-lock.yaml, then pac
- `batch_query_vulnerabilities`: Check a whole npm dependency inventory against OSV.dev in one call: pass `packages: [{name, version?}]`, or raw package.json / package-lock / yarn.lock / pnpm-l
- `check_license_compliance`: Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny li
- `check_maintainer_blast_radius`: Given an npm username, lists the packages npm's maintainer:<username> search index returns for that account and looks for a tight cluster of packages whose late
- `check_maintainer_changes`: Reconstruct who has controlled an npm package and when, straight from the packument (each version records the maintainer list at publish time and who ran `npm p
- `check_package_provenance`: Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance 
- `compare_packages`: Compare 2-5 candidate packages for the same job (e.g. "axios vs got vs node-fetch") side by side and get a deterministic pick. More than 5 names is rejected, ne
- `diff_dependencies`: Compare two snapshots of a package.json, package-lock.json (v1-v3), yarn.lock (classic or Berry) or pnpm-lock.yaml (e.g. before/after a PR; formats can differ) 
- `enrich_npm_audit`: Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need t
- `generate_sbom`: Given the same inputs batch_query_vulnerabilities accepts — either a flat {packages:[...]} list, or raw package.json / lockfile / CycloneDX JSON / SPDX JSON con
- `get_cve`: Look up authoritative NIST NVD data for one exact CVE ID (e.g. "CVE-2026-2950"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date rang
- `get_latest_advisories`: Browse recently published npm security advisories and known-malicious-package findings. Three disjoint sources, selected via type: "reviewed" (default) is GitHu
- `get_maintainer_profile`: Given an npm username, returns every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search 
- `get_package`: Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, recent version 
- `get_package_version`: Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball) AND check that exact version against OSV.dev for known vulne
- `get_remediation_playbook`: Maps a finding's `rule` value from analyze_install_script, check_maintainer_changes, or check_package_provenance to the matching human-authored incident-respons
- `prioritize_remediation`: Rank vulnerability findings other tools already returned (batch_query_vulnerabilities, query_vulnerabilities, analyze_transitive_dependencies, diff_dependencies
- `query_vulnerabilities`: Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile i
- `search_packages`: Search the npm registry by name or keywords. Each result includes its current weekly/monthly download counts, dependentsCount (how many other npm packages depen
- `simulate_dependency_upgrade`: Before running npm install, check whether upgrading a package from a current to a target version is safe. Pass `packageName` + `currentVersion` + `targetVersion
- `suggest_alternative`: Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.