@nekzus/mcp-server
Advanced tools
NPM Sentinel MCP - A powerful Model Context Protocol (MCP) server that revolutionizes NPM package analysis through AI. Built to integrate with Claude and Anthropic AI, it provides real-time intelligence on package security, dependencies, and performance.
A powerful Model Context Protocol (MCP v2) server built on @modelcontextprotocol/server and @modelcontextprotocol/core (v2) that revolutionizes NPM package analysis through AI. Built to integrate seamlessly with Claude, Anthropic AI, and any MCP v2 compatible client, it provides real-time intelligence on package security, dependencies, and performance.
This server features Modular ESM Architecture (src/), Dual Output Protocol Returns (content + structuredContent), Zod Output Schemas (outputSchema), Embedded SVG Data URI Icons, and Real-Time Context Logging.
outputSchema Zod validation, dual structuredContent returning, and diagnostic context logging (ctx.mcpReq.log).data:image/svg+xml) embedded across all 19 tools, resources, and prompts for enhanced client UI presentation.deps.dev and OSV.dev, ecosystem awareness, and accurate version resolution.npmAlternatives): Intelligent search based on functional domain keywords with strict ecosystem plugin/extension filtering (e.g., excludes express-rate-limit when searching for alternatives to express).npmSearch) are capped at 100 characters and filtered for control characters. Batch analysis tools enforce a strict cap of 25 packages per request to prevent registry enumeration DoS.deps.dev.express@2, express@v4, zod@3.x, react@^18, lodash@~4.17) to the highest matching release without failing on missing exact version keys.npmPackageReadme, npmChangelogAnalysis) wrap untrusted content in <untrusted_external_content> tags, attach _meta.untrustedExternalContent = true flags, and enforce strict tool schema warnings.pnpm-lock.yaml, package-lock.json, yarn.lock) with manual bypass (ignoreCache: true).This server implements Defense-in-Depth controls aligned with OWASP LLM01:2025 (Indirect Prompt Injection):
README.md, GitHub changelogs, release notes) is wrapped inside <untrusted_external_content source="..." package="..." type="..."> tags so consuming LLM models distinguish untrusted data from instructions._meta): Responses include _meta.untrustedExternalContent = true and _meta.sources arrays for programmatic client-side detection and policy enforcement.PackageListSchema). Search queries are sanitized and capped at 100 characters (SearchQuerySchema).Object.hasOwn() checks on dictionary lookups (blocking reserved properties like constructor and __proto__).To ensure data accuracy while maintaining high performance:
pnpm-lock.yaml, package-lock.json, or yarn.lock changes in your workspace.ignoreCache: true parameter to bypass the cache and force a fresh lookup from the NPM registry.{
"name": "npmVersions",
"arguments": {
"packages": ["react"],
"ignoreCache": true
}
}
2025-11-25 + v2 2026-07-28)This MCP server features native Dual-Era Protocol Compatibility, seamlessly serving both modern MCP v2 clients (2026-07-28) and legacy MCP v1 clients (2025-11-25) out of the box across both STDIO and Streamable HTTP transports:
npx @nekzus/mcp-server): Powered by serveStdio({ legacy: "serve" }). Handles modern server/discover probes sessionlessly and conjoins seamlessly with legacy initialize handshakes for local execution (Claude Desktop, Cursor, Docker).@nekzus/mcp-server/http): Powered by createMcpHandler({ legacy: "stateless" }). Designed for serverless and web-standard runtimes (Cloudflare Workers, Hono, Express, Vercel API Routes, Smithery.ai).Example: Mounting HTTP Handler (Cloudflare Workers / Hono / Express)
import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleRequest = createMcpHttpHandler();
export default {
async fetch(request, env, ctx) {
return handleRequest(request);
}
};
Development Commands:
# Install dependencies
pnpm install
# Compile TypeScript to dist/
pnpm run build
# Start STDIO server (Dual-Era)
pnpm run start
# Development server with Smithery CLI playground
pnpm run dev
# Run full unit and integration test suite (238 tests)
pnpm test -- --run
# Run full E2E tarball verification
node __tests__/full-e2e-pack-validation.js
Add this to your VS Code / Cursor MCP configuration:
{
"inputs": [],
"servers": {
"npm-sentinel": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@nekzus/mcp-server@latest"]
}
}
}
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"npm-sentinel": {
"command": "npx",
"args": ["-y", "@nekzus/mcp-server@latest"]
}
}
}
Configuration File Locations:
%APPDATA%\Claude\claude_desktop_config.json~/Library/Application Support/Claude/claude_desktop_config.json~/.config/Claude/claude_desktop_config.json{
"mcpServers": {
"npm-sentinel": {
"type": "http",
"url": "https://smithery.ai/server/@Nekzus/npm-sentinel-mcp"
}
}
}
# Build Docker image
docker build -t nekzus/npm-sentinel-mcp .
# Run with local volume mount
docker run -i --rm -w /projects -v ${PWD}:/projects nekzus/npm-sentinel-mcp node dist/index.js
The package exports createMcpHttpHandler and WebStandardStreamableHTTPServerTransport for serverless platforms (Cloudflare Workers, Hono, Vercel, Express, Fastify, Next.js API routes) requiring official Web Standard Streamable HTTP transport under MCP v2:
import { createMcpHttpHandler } from '@nekzus/mcp-server/http';
const handleMcpRequest = createMcpHttpHandler();
export default {
async fetch(request: Request): Promise<Response> {
return handleMcpRequest(request);
},
};
100% MCP v2 Compliance: Powered by WebStandardStreamableHTTPServerTransport, this handler natively activates all 3 MCP primitives (Tools, Resources, and Prompts) with peak performance, SSE streaming support, and full Web Standard Request $\rightarrow$ Response compatibility.
The server supports the following configuration parameters:
| Environment Variable | Config Object Property | Default | Description |
|---|---|---|---|
NPM_REGISTRY_URL | config.NPM_REGISTRY_URL | https://registry.npmjs.org | URL of the NPM registry to use for all requests |
All tool responses conform to the MCP v2 dual output format, providing both human-readable text in content and parsed JSON objects in structuredContent:
{
"content": [
{
"type": "text",
"text": "{\n \"queryPackages\": [\"express\"],\n \"results\": [...]\n}"
}
],
"structuredContent": {
"queryPackages": ["express"],
"results": [...]
}
}
Accessible via MCP readResource requests:
doc://server/readme
text/markdowndoc://mcp/specification
llms-full.txt).text/plainAccessible via MCP getPrompt requests:
analyze-package
package (string, required)All 19 tools define inputSchema, outputSchema, annotations (title, readOnlyHint), and icons:
npmLatestpackages (string[]), ignoreCache (boolean, optional)npmVersionspackages (string[]), ignoreCache (boolean, optional)npmDepsdeps.dev.packages (string[]), ignoreCache (boolean, optional)npmTypesindex.d.ts declaration files vs @types/* DefinitelyTyped packages).packages (string[]), ignoreCache (boolean, optional)npmSizepackages (string[]), ignoreCache (boolean, optional)npmVulnerabilitiesdeps.dev and OSV.dev advisories.packages (string[]), ignoreCache (boolean, optional)npmTrendslast-week, last-month, last-year).packages (string[]), period ("last-week" | "last-month" | "last-year"), ignoreCache (boolean, optional)npmComparepackages (string[]), ignoreCache (boolean, optional)npmMaintainerspackages (string[]), ignoreCache (boolean, optional)npmScorepackages (string[]), ignoreCache (boolean, optional)npmPackageReadmepackages (string[]), ignoreCache (boolean, optional)npmSearchquery (string), limit (number, optional)npmLicenseCompatibilitypackages (string[]), ignoreCache (boolean, optional)npmRepoStatspackages (string[]), ignoreCache (boolean, optional)npmDeprecatedpackages (string[]), ignoreCache (boolean, optional)npmChangelogAnalysispackages (string[]), ignoreCache (boolean, optional)npmAlternativesexpress-rate-limit for express).packages (string[]), ignoreCache (boolean, optional)npmQualitypackages (string[]), ignoreCache (boolean, optional)npmMaintenancepackages (string[]), ignoreCache (boolean, optional)This MCP server is licensed under the MIT License. See LICENSE for details.
MIT © nekzus
FAQs
NPM Sentinel MCP - A powerful Model Context Protocol (MCP) server that revolutionizes NPM package analysis through AI. Built to integrate with Claude and Anthropic AI, it provides real-time intelligence on package security, dependencies, and performance.
The npm package @nekzus/mcp-server receives a total of 861 weekly downloads. As such, @nekzus/mcp-server popularity was classified as not popular.
We found that @nekzus/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.