Npm Sentinel MCP
by NekzusA powerful Model Context Protocol (MCP) server that revolutionizes NPM package analysis through AI.
Npm Sentinel MCP is an open-source mcp server by Nekzus, written mainly in TypeScript, with 19 GitHub stars and the MIT license. Its code was last updated Aug 24, 2026.
Scan summary: scanned Nov 5, 2026 at commit 98964a1. Seen able to read environment and secrets. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
98964a1 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine. BootsIt started, and MCP servers answered the protocol handshake. No undeclared egressWhile running it only contacted the domains it declared. ReproducibleEarned in this scan.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Secrets scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Dependency audit206 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Passed. This check ran and found nothing it flags.Manifestserver.jsonpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Boot & handshake19 toolspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Network egresspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Reproducible (×3)passPassed. This check ran and found nothing it flags.
Findings (42)
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@fastify/busboy@2.1.1: 2 known vulnerabilitiesGHSA-gxm5-99cw-xjw9, GHSA-x8mw-p69m-v3mx
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/client@2.0.0: 4 known vulnerabilitiesGHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.30.0: 6 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/server@2.0.0: 8 known vulnerabilitiesGHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-jm63-cq47-j5jp, GHSA-rvq5-wwqv-78pq, GHSA-46jr-4wx8-v453 +3 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.3.0: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.7: 5 known vulnerabilitiesGHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.4: 11 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.2.0: 16 known vulnerabilitiesGHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +11 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.3.0: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.16: 1 known vulnerabilityGHSA-2v37-7h3g-55p8
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 2 known vulnerabilitiesGHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tar@7.5.19: 1 known vulnerabilityGHSA-r292-9mhp-454m
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@5.29.0: 16 known vulnerabilitiesGHSA-2m5v-pch6-74hx, GHSA-2mjp-6q6p-2qxm, GHSA-35p6-xmwp-9g52, GHSA-4992-7rv2-5pvq, GHSA-8xcm-r25x-g524 +11 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@6.27.0: 22 known vulnerabilitiesGHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524, GHSA-9fm3-97px-rjf6 +17 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@8.1.5: 5 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.4.3: 2 known vulnerabilitiesGHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.3: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +7 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.15: 2 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.16: 2 known vulnerabilitiesGHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.28.0: 23 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@6.4.3: 5 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
__tests__/full-e2e-pack-validation.js:20 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
__tests__/full-e2e-pack-validation.js:52 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
__tests__/integration/dual-era-pack-e2e.test.ts:29 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
__tests__/integration/dual-era-pack-e2e.test.ts:30 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
__tests__/integration/dual-era-pack-e2e.test.ts:56 - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@2.0.12: 1 known vulnerabilityGHSA-rmxm-3fg6-px4f
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@vitest/mocker@4.1.10: 4 known vulnerabilitiesGHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8, GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@13.0.6: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.hono@4.12.32: 9 known vulnerabilitiesGHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ip-address@10.3.1: 5 known vulnerabilitiesGHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.5: 1 known vulnerabilityGHSA-g3hv-75wg-m249
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.4: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.3: 6 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw +1 more
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.vitest@4.1.10: 2 known vulnerabilitiesGHSA-82fw-gwwq-j7x9, GHSA-82fw-gwwq-j7x9
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@1.19.14: 2 known vulnerabilitiesGHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.hono@4.12.29: 9 known vulnerabilitiesGHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.package.json has a prepare scripthusky
package.json - lowLow. Minor, or common in normal tools. Shown for information.Reads environment variables not listed in the manifestNPM_REGISTRY_URL, VITEST
Network activity
During install
registry.npmjs.org
While running
No connections
Tools exposed (19)
npmVersionsGet all available versions of an NPM package
npmLatestGet the latest version and changelog of an NPM package
npmDepsAnalyze dependencies and devDependencies of an NPM package
npmTypesCheck TypeScript types availability and version for a package
npmSizeGet package size information including dependencies and bundle size
npmVulnerabilitiesCheck for known vulnerabilities in packages
npmTrendsGet download trends and popularity metrics for packages
npmCompareCompare multiple NPM packages based on various metrics
npmMaintainersGet maintainers information for NPM packages
npmScoreGet consolidated package score based on quality, maintenance, and popularity metrics
npmPackageReadmeGet the README content for NPM packages
npmSearchSearch for NPM packages with optional limit
npmLicenseCompatibilityCheck license compatibility between multiple packages
npmRepoStatsGet repository statistics for NPM packages
npmDeprecatedCheck if packages are deprecated
npmChangelogAnalysisAnalyze changelog and release history of packages
npmAlternativesFind alternative packages with similar functionality
npmQualityAnalyze package quality metrics
npmMaintenanceAnalyze package maintenance metrics
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Npm Sentinel MCP alternatives
View more →Similar mcp servers in Research & Analysis, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Npm Sentinel MCP (this page) Nekzus | 19 | MIT | Aug 24, 2026 | Scanned, no flagged issues |
| Worldmonitor koala73 | 90k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| GPT Researcher assafelovic | 30k | Apache-2.0 | Oct 10, 2026 | Scanned, no flagged issues |
| Auto Claude Code Research In Sleep wanshuiyin | 18k | MIT | Nov 1, 2026 | Scanned, no flagged issues |
| Deep Research u14app | 4.7k | MIT | Jun 18, 2026 | Scanned, no flagged issues |
| MCP Server Chart antvis | 4.4k | MIT | Aug 27, 2026 | Scanned, no flagged issues |