npmAlternatives
Find alternative packages with similar functionality
LABSCO SUMMARY
The dependency review you would do by hand, as one set of calls.
Adding a package is a decision with several inputs — vulnerabilities, size, licence, maintenance, deprecation, whether something better exists — and each of them normally lives on a different site. Two details show care: alternatives are filtered so a plugin for a library is never offered as a replacement for it, and README and changelog text comes back wrapped in explicit untrusted-content markers, because that text is third-party and an agent will otherwise read instructions inside it.
What it is
An npm intelligence server. It answers the questions that otherwise mean five browser tabs: which versions exist, what the package pulls in, how big it gets, whether it has known vulnerabilities, whether anyone still maintains it, and what else does the same job.
What you get
- Every published version of a package, and the latest one with its changelog
- Dependencies and devDependencies analysed, with the transitive tree mapped through deps.dev
- Known vulnerabilities checked recursively through deps.dev and OSV.dev, with ecosystem awareness and proper version resolution
- Install size and bundle size, dependencies included
- TypeScript type availability and version
- Download trends over a period, and repository statistics
- Quality, maintenance and a consolidated score, drawing on OpenSSF Scorecard, GitHub repository metrics and npms.io
- Several packages compared on those metrics at once, and licence compatibility checked between them
- Deprecation status, maintainer information, and the package README
- Changelog and release history analysed across versions
- Alternatives found by functional domain with ecosystem plugins filtered out — express-rate-limit does not come back as an alternative to express
- Registry search, with the query capped at 100 characters
- SemVer shorthand resolved transparently: express@2, express@v4, zod@3.x, react@^18 and lodash@~4.17 all land on the highest matching release
- README and changelog content wrapped in untrusted-content tags and flagged in the response metadata, so a model treats third-party documentation as data rather than instruction
- A cache invalidated automatically when pnpm-lock.yaml, package-lock.json or yarn.lock changes, with a per-call flag to force a fresh lookup
Requirements
Node.js, launched with npx @nekzus/mcp-server@latest over stdio, or run from the published Docker image. No account and no key — it reads the public npm registry and the public data sources behind it. Batch tools cap at 25 packages per request and search queries at 100 characters, to keep a request from turning into registry enumeration. The same binary serves both the 2025-11-25 and 2026-07-28 protocol revisions, over stdio or Streamable HTTP, and the HTTP handler mounts inside Cloudflare Workers, Hono, Express or a Vercel route.
Setup effort
One command — npx -y @nekzus/mcp-server@latest
USE CASES
01
Deciding whether to add a dependency
Check its vulnerabilities, its size and its licence compatibility together, before it reaches the lockfile.
02
Choosing between two packages
Compare them on the metrics side by side, then read their quality and consolidated scores.
03
Finding out whether something is still alive
Read the deprecation status, the maintenance metrics, the download trend and the repository statistics.
04
Working out what an upgrade will cost you
List the versions, then read the changelog analysis between where you are and where you are going.
05
Replacing something abandoned
Find alternatives by what the package actually does, with its own plugins filtered out, then compare them.
06
Checking the tree, not just the package
Analyse dependencies and devDependencies, then scan the transitive graph for known vulnerabilities.
07
Finding a package for a job
Search the registry, read the README, and check whether types ship with it before committing.
19 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
npmChangelogAnalysis
Analyze changelog and release history of packages
npmCompare
Compare multiple NPM packages based on various metrics
npmDeprecated
Check if packages are deprecated
npmDeps
Analyze dependencies and devDependencies of an NPM package
npmLatest
Get the latest version and changelog of an NPM package
npmLicenseCompatibility
Check license compatibility between multiple packages
npmMaintainers
Get maintainers information for NPM packages
npmMaintenance
Analyze package maintenance metrics
npmPackageReadme
Get the README content for NPM packages
npmQuality
Analyze package quality metrics
npmRepoStats
Get repository statistics for NPM packages
npmScore
Get consolidated package score based on quality, maintenance, and popularity metrics
npmSearch
Search for NPM packages with optional limit
npmSize
Get package size information including dependencies and bundle size
npmTrends
Get download trends and popularity metrics for packages
npmTypes
Check TypeScript types availability and version for a package
npmVersions
Get all available versions of an NPM package
npmVulnerabilities
Check for known vulnerabilities in packages
BEFORE YOU INSTALL
What to know first
Tools you get
19 tools when we connected. Every tool except npmSearch takes a packages list capped at 25 packages per request.
Requires
npx on PATH
Where it runs
All 4 documented clients run the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 19 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @nekzus/mcp-server@latestMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"npm-sentinel": {
"command": "npx",
"args": [
"-y",
"@nekzus/mcp-server@latest"
]
}
}
}VS Code
VS CODE · JSON
{
"inputs": [],
"servers": {
"npm-sentinel": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@nekzus/mcp-server@latest"
]
}
}
}Cursor
CURSOR · JSON
{
"mcpServers": {
"npm-sentinel": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@nekzus/mcp-server@latest"
]
}
}
}Any MCP client — Docker
ANY MCP CLIENT — DOCKER · JSON
{
"mcpServers": {
"npm-sentinel": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"mcp/npm-sentinel"
]
}
}
}
