npmscan-mcp-plugin
NPMScan plugin for Claude Code that checks npm packages for vulnerabilities, malware, and maintainer risks for developers and anyone managing dependencies.
What it is good for
- Checking whether npm packages have known security vulnerabilities
- Auditing a project's dependencies before shipping updates
- Investigating whether an npm package was compromised or is safe to use
- Comparing candidate npm packages before adding one to a project
At a glance
- Who it is for
- Setup
- Install a desktop app or browser extension
Level 3 of 5. Download and install it like any other app or extension.
- Cost
- Free and open source
- Type
- Skill or plugin
- Tasks
- Works with
- Claude Code, Gemini CLI, Claude, ChatGPT, GitHub Copilot
Momentum
- Rank this week
- Not ranked (last #79, week 43, 2026)
- Best rank
- #79 week 43, 2026
- GitHub stars
- 509
GitHub numbers as of Nov 2, 2026. Updated weekly.
Ranking history
Official links
Setup steps are on the official pages. We do not repeat them here, since they change.
Questions
- Is npmscan-mcp-plugin free?
- Yes. It is free and open source (MIT license).
- Do I need to know how to code to use npmscan-mcp-plugin?
- No. Download and install it like any other app or extension.
- What does npmscan-mcp-plugin work with?
- According to its own documentation, it works with Claude Code, Gemini CLI, Claude, ChatGPT, and GitHub Copilot.
- What is npmscan-mcp-plugin good for?
- Checking whether npm packages have known security vulnerabilities, auditing a project's dependencies before shipping updates, investigating whether an npm package was compromised or is safe to use, and comparing candidate npm packages before adding one to a project.
Similar agents to npmscan-mcp-plugin
- Floorplan
Floorplan is a plugin that shows how an app fits together as an interactive plain-English map for people building with Claude Code or Codex.
- Multica
Multica is a workspace that lets teams assign issues to AI coding agents like teammates for developers and managers who run several agents.
- CodeBurn
CodeBurn is a local tool that tracks what your AI coding tools cost, broken down by project, model and task, for developers.
- visual-explainer
Visual-explainer is a skill that turns terminal diagrams, diff reviews, and data tables into styled HTML pages for developers and technical readers.
- SwiftUI-Agent-Skill
SwiftUI Expert Skill is a skill that adds SwiftUI best-practice guidance to AI coding tools for developers building iPhone and Mac apps.
- Stop That Shit
Stop That Shit is a skill and guard that keeps AI coding agents from adding unrequested hashes, checksums, and extra scope to a task.