NPM Sentinel MCP
About
A powerful Model Context Protocol (MCP) server that revolutionizes NPM package analysis through AI.
Details
- Author
- Nekzus
- GitHub stars
- 18
- Downloads
- 363
- Categories
- Developer Tools, Other
Jump to
- Version analysis and tracking
- Dependency analysis and mapping
- Advanced security scanning with recursive dependency checks
- Strict input validation against Path Traversal, SSRF, Command Injection
- Package quality metrics and score assessment
- Download trends and statistics
- TypeScript support verification
- Package size analysis and maintenance metrics
- Efficient caching with automatic invalidation on lockfile changes
- Real‑time package comparisons
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
NPM Sentinel MCPCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install the server via NPX (npx -y @nekzus/mcp-server@latest), Docker, or deploy it on Smithery.ai. Configure it in your AI client (e.g., VS Code, Claude Desktop) by adding a server entry with the command above. The server supports both STDIO and HTTP streamable transports and exposes tools through the MCP protocol.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"npm sentinel mcp": {
"npm-sentinel-mcp": {
"command": "docker",
"args": [
"build",
"-t",
"nekzus/npm-sentinel-mcp",
"."
]
}
}
}
}McpServers
{
"npm-sentinel-mcp": {
"command": "docker",
"args": [
"build",
"-t",
"nekzus/npm-sentinel-mcp",
"."
]
}
}NPM Sentinel MCP
<div align="center">
</div>
A powerful Model Context Protocol (MCP) server that revolutionizes NPM package analysis through AI. Built to integrate with Claude and Anthropic AI, it provides real-time intelligence on package security, dependencies, and performance. This MCP server delivers instant insights and smart analysis to safeguard and optimize your npm ecosystem, making package management decisions faster and safer for modern development workflows.
Features
- Version analysis and tracking
- Dependency analysis and mapping
- Advanced Security Scanning: Recursive dependency checks, ecosystem awareness (e.g., React), and accurate version resolution.
- Strict Input Validation: Protection against Path Traversal, SSRF, and Command Injection via rigorous input sanitization.
- Package quality metrics
- Download trends and statistics
- TypeScript support verification
- Package size analysis
- Maintenance metrics
- Real-time package comparisons
- Standardized error handling and MCP response formats
- Efficient caching for improved performance and API rate limit management
- Rigorous schema validation and type safety using Zod
Note: The server provides AI-assisted analysis through MCP integration.
Caching and Invalidation
To ensure data accuracy while maintaining performance, the server implements robust caching strategies:
- Automatic Invalidation: The cache is automatically invalidated whenever pnpm-lock.yaml, package-lock.json, or yarn.lock changes in your workspace. This ensures you always get fresh data after installing or updating dependencies.
- Force Refresh: All tools accept an optional ignoreCache: true parameter to bypass the cache and force a fresh lookup from the registry.
Example Usage (JSON-RPC)
When calling a tool, simply include ignoreCache: true in the arguments:
{
"name": "npmVersions",
"arguments": {
"packages": ["react"],
"ignoreCache": true
}
}
Installation
Migration to HTTP Streamable
This MCP server now supports both STDIO and HTTP streamable transport. Your existing STDIO configuration will continue to work without changes.
New capabilities:
- HTTP streamable transport via Smithery.ai
- Enhanced scalability and performance
- Interactive testing playground
Development commands:
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
