check_package_provenance — NPMScan MCP Tool Read-only
check_package_provenance
(check package provenance) is one of 23 tools on the
NPMScan
MCP server. Connect the server and your client discovers it on the handshake.
by client
How to call check_package_provenance from your client
- Claude Code NPMScan check_package_provenance run in your project directory
- Claude Desktop NPMScan check_package_provenance ~/Library/Application Support/Claude/claude_desktop_config.json
- Cursor NPMScan check_package_provenance ~/.cursor/mcp.json
- VS Code NPMScan check_package_provenance .vscode/mcp.json
- Zed NPMScan check_package_provenance ~/.config/zed/settings.json
- Windsurf NPMScan check_package_provenance ~/.codeium/windsurf/mcp_config.json
- Cline NPMScan check_package_provenance ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json
- Gemini CLI NPMScan check_package_provenance ~/.gemini/settings.json
- Grok NPMScan check_package_provenance .mcp.json (in your project root)
- ChatGPT NPMScan check_package_provenance Settings → Connectors → Advanced → Developer mode
- Claude.ai NPMScan check_package_provenance Settings → Connectors → Add custom connector
- LangChain NPMScan check_package_provenance pip install langchain-mcp-adapters
Fastest route
claude mcp add --transport http npmscan https://npmscan.com/api/mcpOther tools on this server
- search_packages
- get_package
- get_package_version
- get_maintainer_profile
- query_vulnerabilities
- batch_query_vulnerabilities
- get_latest_advisories
- get_cve
- analyze_install_script
- analyze_transitive_dependencies
- check_maintainer_changes
- check_maintainer_blast_radius
- check_license_compliance
- diff_dependencies
- prioritize_remediation
- simulate_dependency_upgrade
- suggest_alternative
- compare_packages
- audit_github_repository
- get_remediation_playbook
- generate_sbom
- enrich_npm_audit
This list was read from the server itself, by connecting to it and calling tools/list on 24 September 2026. It is what
the server actually exposes, not what its listing claims.
Mutating and Read-only are read off each tool's name, not its schema — a hint, not a guarantee. The registry stores tool names only; connect the server for its live schemas.