NPMScan MCP Tools

• search_packages Read-only

  search packages

• get_package Read-only

  get package

• get_package_version Read-only

  get package version

• get_maintainer_profile Read-only

  get maintainer profile

• query_vulnerabilities Read-only

  query vulnerabilities

• batch_query_vulnerabilities

  batch query vulnerabilities

• get_latest_advisories Read-only

  get latest advisories

• get_cve Read-only

  get cve

• analyze_install_script

  analyze install script

• analyze_transitive_dependencies

  analyze transitive dependencies

• check_package_provenance Read-only

  check package provenance

• check_maintainer_changes Read-only

  check maintainer changes

• check_maintainer_blast_radius Read-only

  check maintainer blast radius

• check_license_compliance Read-only

  check license compliance

• diff_dependencies

  diff dependencies

• prioritize_remediation

  prioritize remediation

• simulate_dependency_upgrade

  simulate dependency upgrade

• suggest_alternative

  suggest alternative

• compare_packages

  compare packages

• audit_github_repository

  audit github repository

• get_remediation_playbook Read-only

  get remediation playbook

• generate_sbom

  generate sbom

• enrich_npm_audit

  enrich npm audit

This list was read from the server itself, by connecting to it and calling tools/list on 24 September 2026. It is what the server actually exposes, not what its listing claims.

Mutating and Read-only are read off each tool's name, not its schema — a hint, not a guarantee. The registry stores tool names only; connect the server for its live schemas.