{"name":"io.github.YawLabs/npmjs-mcp","slug":"yawlabs-npmjs-mcp","title":"npm Registry MCP Server","description":"npm registry MCP server — package intelligence, security audits, dependency analysis","url":"https://mcp.market/server/yawlabs-npmjs-mcp","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":38,"stars":2,"forks":1,"downloads_week":1306,"last_push_at":"2026-09-14T19:37:12.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/YawLabs/npmjs-mcp","website":"https://yaw.sh/mcp-servers/npmjs-mcp/","version":"0.16.3","remotes":[],"packages":[{"registryType":"npm","identifier":"@yawlabs/npmjs-mcp","version":"0.16.3","transport":{"type":"stdio"}}],"tools":[{"name":"npm_access_set","description":"Set package access level: 'public' or 'restricted' (private). 'private' is accepted as an alias for 'restricted' for ergonomics -- both map to the registry wire value 'restricted'. Unscoped packages are always public. Restricted access requires a paid npm account.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_access_set_mfa","description":"Configure 2FA requirement for publishing: 'none' (off), 'publish' (2FA required), 'automation' (2FA required but automation tokens can bypass).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_audit","description":"Quick vulnerability check for specific packages and versions using the bulk advisory API. Returns matching advisories with severity, CVEs, and patched versions. For richer detail (CVSS scores, CWEs, fix recommendations), use npm_audit_deep instead.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_audit_deep","description":"Full security audit on a dependency set \\u2014 returns detailed advisories with CVSS scores, CWEs, affected version ranges, fix recommendations, and full vulnerability metadata. Uses the npm audit v1 endpoint which provides richer detail than the bulk advisory API (npm_audit). Requires you to provide the dependency map (use npm_dependencies to get it first).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_check_auth","description":"Quick auth health check \\u2014 returns structured data about npm auth status, token capability, and whether headless (CI/agent) publishing is possible. Run this BEFORE attempting any publish operation. Returns canPublishHeadless boolean and a clear recommendation. MCP servers are called by AI agents which CANNOT open browsers or enter OTP codes. This tool detects that and provides the exact termin","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_collaborators","description":"Get all users who have access to a package and their permission levels (read-only, read-write). Useful for verifying who can publish to a package before setting up CI/CD.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_compare","description":"Compare 2-5 packages side-by-side \\u2014 downloads, version, license, maintainers, size, last publish, and security status. Great for 'should I use X or Y?' decisions.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_dep_tree","description":"Resolve the production dependency tree for a package version (up to a configurable depth). Shows the full transitive dependency graph with versions. Issues one registry request per discovered package (10 in flight), so a wide tree at depth 4-5 can take a while; the walk is capped at 60s and returns `truncated: true` with a warning if it runs out of budget.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_dependencies","description":"Get the dependency lists for a specific package version \\u2014 production deps, devDeps, peerDeps, and optionalDeps.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_deprecate","description":"Deprecate a package or specific versions. Shows a warning message on install. Uses the HTTP API with NPM_TOKEN, so no CLI login or OTP prompt is involved; a token without 2FA bypass is refused with 401 or 403. Registry hard limit: deprecation messages must be <= 1024 characters. A message over the limit, or a versionRange matching no published version, is rejected locally as HTTP 400 before any wr","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_dist_tag_remove","description":"Remove a dist-tag from a package. The 'latest' tag cannot be removed, only reassigned.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_dist_tag_set","description":"Point a dist-tag (e.g. 'latest', 'beta', 'next') at a specific version. Common uses: promote a beta to latest, roll back latest to a prior version, maintain separate channels.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_dist_tags","description":"Get dist-tags for a package (latest, next, beta, etc).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_downloads","description":"Get total download count for a package over a period (last-day, last-week, last-month, last-year, or a custom date range like 2025-01-01:2025-12-31).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_downloads_bulk","description":"Compare download counts for multiple packages over a period. Up to 128 packages. Scoped packages (@scope/name) are NOT supported by the bulk endpoint \\u2014 call npm_downloads separately for each scoped package.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_downloads_range","description":"Get daily download counts for a package over a period. Returns per-day breakdown.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_health","description":"Assess the health of a package \\u2014 maintenance activity, download trend, security status, deprecation, and documentation quality.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_hook_add","description":"Create a registry webhook. Target is 'pkg' or '@scope/pkg' for a package, '@scope' for a scope, or '~user' for a user's packages. Endpoint is the HTTPS URL to POST events to; secret is used to HMAC-sign payloads. The secret is never echoed back in tool responses.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_hook_get","description":"Get a single webhook by its ID. The stored secret is redacted from the response.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_hook_list","description":"List webhooks. Optionally filter by package name. Secrets are redacted from responses.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_hook_remove","description":"Delete a webhook by ID.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_hook_update","description":"Replace a webhook's endpoint AND signing secret. Both are required: the registry PUT overwrites the hook config, so this call always rotates the secret to whatever you pass \\u2014 supply the current secret if you only mean to change the endpoint. The returned hook object has the secret redacted.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_license_check","description":"Check the license of a package and its direct production dependencies. Flags missing or non-standard licenses. Matches single SPDX license identifiers case-insensitively (so 'mit' and 'MIT' both match). SPDX expressions like '(MIT OR Apache-2.0)' are NOT decomposed \\u2014 they are flagged unless added to `allowed` verbatim. Issues 2 requests per direct dependency (10 in flight), capped at 60s; dep","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_maintainers","description":"Get current maintainers and their publish history for a package.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_ops_playbook","description":"Return canonical recipes for common npm operations \\u2014 which MCP tool to call for which op, CLI fallbacks when the MCP server can't handle something, and message format guidance. Call this FIRST when you're not sure how to do an npm operation. Prevents reinventing approaches that don't work.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_org_member_remove","description":"Remove a user from an org. Their team memberships in that org are also removed. Requires confirm: true \\u2014 team memberships cascade and cannot be selectively preserved.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_org_member_set","description":"Add a user to an org or change their role. Roles: 'developer', 'admin', 'owner'. If the user is already in the org, updates the role. Omitting `role` keeps the member's current role: this tool reads the roster first and re-sends the existing role explicitly, because the registry DEFAULTS an omitted role to 'developer' rather than preserving it (which would silently demote an admin or owner). For a","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_org_members","description":"List all members of an npm organization with their roles (owner, admin, developer). Requires authentication as an org member.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_org_packages","description":"List all packages accessible to an npm organization with their access levels. Shows what the org owns or has been granted access to.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_org_teams","description":"List all teams within an npm organization. Requires authentication as an org member.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_owner_add","description":"Add a user as a maintainer of a package. They will have publish and write permissions. Resolves the user's email via /-/user/ (no need to supply it). Use npm_collaborators to verify before adding.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_owner_remove","description":"Remove a user from a package's maintainer list. Refuses if it would leave the package with zero maintainers (lockout prevention).","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_package","description":"Get package metadata \\u2014 description, dist-tags, latest version, maintainers, license, repository, keywords. Does not include per-version details (use npm_version for that).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_package_access","description":"Get package access settings \\u2014 visibility (public/private), whether publish requires 2FA, and whether automation tokens can bypass 2FA. Critical for understanding why CI publishing fails: if publish_requires_tfa is true but automation_token_overrides_tfa is false, automation tokens cannot publish.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_profile","description":"Get the authenticated user's npm profile \\u2014 name, email, 2FA status, creation date. Useful for checking whether 2FA is enabled (which affects token requirements for publishing).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_provenance","description":"Retrieve Sigstore attestations for a specific package version. Shows SLSA provenance (which CI built it, from which repo/commit) and publish attestations. NOTE: this tool RETRIEVES attestations from the registry -- it does NOT perform cryptographic signature, certificate-chain, or Rekor transparency-log verification. Use a dedicated Sigstore client to cryptographically verify the bundles.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_publish_preflight","description":"Comprehensive pre-publish validation \\u2014 run before publishing ANY npm package. Returns an actionable checklist with pass/fail/warn for each item. ASSUMES NON-INTERACTIVE CONTEXT BY DEFAULT because MCP servers are called by AI agents that: - CANNOT open browsers (so --auth-type=web is useless) - CANNOT enter OTP codes - CANNOT retry with 2FA \\u2014 this is a hand-off to the human Checks: auth t","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_readme","description":"Get the README content of a package.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_recent_changes","description":"Get the most recent package publishes/updates from the npm registry via the CouchDB changes feed. Note: uses replicate.npmjs.com which may have intermittent availability.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_registry_stats","description":"Get total npm-wide download counts for a period. Shows overall registry activity.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_release_frequency","description":"Analyze the release cadence of a package \\u2014 publish timeline, gaps, and whether the project is actively maintained.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_search","description":"Search the npm registry for packages. Supports text search and qualifiers like 'keywords:mcp', 'author:user', 'maintainer:user', 'scope:org', 'not:insecure', 'is:unstable'.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_signing_keys","description":"Get the npm registry's ECDSA signing keys used to verify package signatures.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_team_create","description":"Create a team inside an organization. Team is passed as '@scope:team'.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_team_delete","description":"Delete a team. Team is passed as '@scope:team'. Revokes all package permissions that team held, and team memberships are also removed. Requires confirm: true \\u2014 this removes the team and all its package grants in one call. List the team's current grants with npm_team_packages first if you need to preserve them.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_team_grant","description":"Grant a team read-only or read-write permission on a package. Scope and team are passed as @scope:team (e.g. '@yawlabs:devs'). Requires org admin or team admin.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_team_member_add","description":"Add a user to a team. Team is '@scope:team'. User must already be in the org.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_team_member_remove","description":"Remove a user from a team. Team is '@scope:team'. User remains in the org.","write_action":true,"price_micros":0,"input_schema":null},{"name":"npm_team_members","description":"List all members of a team with their roles (e.g. 'developer'). Complements npm_team_member_add and npm_team_member_remove \\u2014 use this to audit who is currently on the team before adding or removing members.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_team_packages","description":"List all packages a specific team has access to and their permission levels (read-only or read-write). Useful for auditing team permissions.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_team_revoke","description":"Revoke a team's access to a package. Team is passed as '@scope:team'. Does not delete the team itself \\u2014 use npm_team_delete for that.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_token_revoke","description":"Revoke an access token by its key (UUID from npm_tokens). Requires confirm: true. Revoking the token currently in use by NPM_TOKEN will break the next call. Creating tokens is NOT exposed because the endpoint requires the user password \\u2014 create via https://www.npmjs.com/settings/~/tokens instead.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_tokens","description":"List all access tokens for the authenticated npm user. Shows token type, creation date, CIDR restrictions, and read-only status. Critical for finding reusable automation/granular tokens that cover your org scope \\u2014 avoids the common mistake of creating duplicate tokens or using publish tokens in CI (which still require OTP).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_trusted_publishers","description":"List trusted publishing configurations for a package. Shows OIDC trust relationships with CI/CD providers (GitHub Actions, GitLab CI, CircleCI) that allow tokenless publishing. Requires authentication with write access to the package.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_types","description":"Check TypeScript type support for a package \\u2014 whether it ships built-in types (types/typings field) or has a DefinitelyTyped companion (@types/* package).","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_undeprecate","description":"Clear the deprecation message from a package or specific versions. Equivalent to npm_deprecate with an empty message but more explicit about intent.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_unpublish_package","description":"Unpublish an ENTIRE package (all versions). DELETE /{pkg}/-rev/{rev}. IRREVERSIBLE: the name is blocked for 72 hours and cannot be re-published. For single-version unpublish prefer npm_unpublish_version. Requires confirm: true.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_unpublish_version","description":"Unpublish a specific version of a package. IRREVERSIBLE: once unpublished, the version cannot be re-published and will be blocked for 72 hours. Only works within 72 hours of the original publish for most packages. Requires explicit confirm: true to prevent accidents. Follows the npm CLI flow (mutate packument + delete tarball). For full-package unpublish use npm_unpublish_package. Dist-tag handlin","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_user_packages","description":"List all packages published by a specific npm user. Shows package names and the user's access level for each. Requires authentication.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_verify_token","description":"Verify the NPM_TOKEN and surface its capabilities \\u2014 username, 2FA status, and whether writes are likely to succeed. Call this FIRST when debugging any write failure to rule out auth issues before trying other fixes. Faster than running writes and interpreting 401/403 errors.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_version","description":"Get detailed metadata for a specific version \\u2014 dependencies, dist info, file count, size, deprecation status.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_version_downloads","description":"Get download counts broken down by version for the last week. Shows version adoption.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_versions","description":"List published versions of a package with their publish dates, ordered newest first. Returns up to `limit` versions (default 50). Set limit=0 to return all.","write_action":false,"price_micros":0,"input_schema":null},{"name":"npm_whoami","description":"Check the currently authenticated npm user. Verifies the NPM_TOKEN is valid and returns the associated username. Essential for debugging auth issues before publishing.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":83,"grade":"B","scanned_at":"2026-09-19T19:54:15.207Z","report":{"scannerVersion":"0.1.5","scannedAt":"2026-09-19T19:54:15.161Z","components":{"code":{"score":20,"max":25,"notes":["3 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 5 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/index.js: …ode, sch); const makeValidate = new Function(`${names_1.default.self}`, `${names_1.de…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@yawlabs/npmjs-mcp","version":"0.16.3","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-09-14T19:39:58.131Z","repositoryUrl":"git+https://github.com/YawLabs/npmjs-mcp.git"}],"repo":{"found":true,"owner":"YawLabs","repo":"npmjs-mcp","archived":false,"pushedAt":"2026-09-14T19:37:12Z","stars":2,"forks":1,"openIssues":0,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/260788729?v=4","ownerCreatedAt":"2026-02-11T00:00:33Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/260788729?v=4&s=128","source":"registry","width":128,"height":128},"presence":{"stars":2,"forks":1,"downloadsWeek":1306,"license":"MIT","lastPushAt":"2026-09-14T19:37:12.000Z","score":38}}}},"grade_history":[],"reviews":[]}