MCP server

NPMScan

io.github.salemalem/npmscan

Checked 26 Oct 2026, 08:29 UTC · It answered and asked for a sign-in

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Needs an API key

https://npmscan.com/api/mcp

At a glance

Type: MCP server
Publisher: Not verified
Status: Needs an API key
Sets up in: Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok
Last checked: 26 Oct 2026, 08:29 UTC

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http npmscan https://npmscan.com/api/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.npmscan]
url = "https://npmscan.com/api/mcp"

Gemini CLI

{"mcpServers":{"npmscan":{"httpUrl":"https://npmscan.com/api/mcp"}}}

Cursor

{"mcpServers":{"npmscan":{"url":"https://npmscan.com/api/mcp"}}}

VS Code

{"servers":{"npmscan":{"type":"http","url":"https://npmscan.com/api/mcp"}}}

Antigravity

agy mcp add npmscan https://npmscan.com/api/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"npmscan","server_url":"https://npmscan.com/api/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"npmscan","server_url":"https://npmscan.com/api/mcp"}

Needs an API key or token from its maker, usually added as a header in the setup.

Stack Facts
Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap.
Nullcone Threat Intelligence
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
CVE Risk Check
Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.
DepScout
Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
overflo.ws
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
Jeevesus — DugganUSA threat-intel MCP
Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.
MCP Registry Search
Search and browse every MCP server in the Model Context Protocol registry.
PG1 Sovereign Threat Intelligence
Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.

[![AptLynx](https://aptlynx.net/badge/io.github.salemalem/npmscan.svg)](https://aptlynx.net/servers/io.github.salemalem/npmscan)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents