Adding a package is a decision with several inputs — vulnerabilities, size, licence, maintenance, deprecation, whether something better exists — and each of them normally lives on a different site. Two details show care: alternatives are filtered so a plugin for a library is never offered as a replacement for it, and README and changelog text comes back wrapped in explicit untrusted-content markers, because that text is third-party and an agent will otherwise read instructions inside it.
An npm intelligence server. It answers the questions that otherwise mean five browser tabs: which versions exist, what the package pulls in, how big it gets, whether it has known vulnerabilities, whether anyone still maintains it, and what else does the same job.
- Every published version of a package, and the latest one with its changelog
- Dependencies and devDependencies analysed, with the transitive tree mapped through deps.dev
- Known vulnerabilities checked recursively through deps.dev and OSV.dev, with ecosystem awareness and proper version resolution
- Install size and bundle size, dependencies included
- TypeScript type availability and version
- Download trends over a period, and repository statistics
- Quality, maintenance and a consolidated score, drawing on OpenSSF Scorecard, GitHub repository metrics and npms.io
- Several packages compared on those metrics at once, and licence compatibility checked between them
- Deprecation status, maintainer information, and the package README
- Changelog and release history analysed across versions
- Alternatives found by functional domain with ecosystem plugins filtered out — express-rate-limit does not come back as an alternative to express
- Registry search, with the query capped at 100 characters
- SemVer shorthand resolved transparently: express@2, express@v4, zod@3.x, react@^18 and lodash@~4.17 all land on the highest matching release
- README and changelog content wrapped in untrusted-content tags and flagged in the response metadata, so a model treats third-party documentation as data rather than instruction
- A cache invalidated automatically when pnpm-lock.yaml, package-lock.json or yarn.lock changes, with a per-call flag to force a fresh lookup
Node.js, launched with npx @nekzus/mcp-server@latest over stdio, or run from the published Docker image. No account and no key — it reads the public npm registry and the public data sources behind it. Batch tools cap at 25 packages per request and search queries at 100 characters, to keep a request from turning into registry enumeration. The same binary serves both the 2025-11-25 and 2026-07-28 protocol revisions, over stdio or Streamable HTTP, and the HTTP handler mounts inside Cloudflare Workers, Hono, Express or a Vercel route.
One command — npx -y @nekzus/mcp-server@latest