check_vulnerabilities
Check if a specific version of an npm package has known security vulnerabilities.
LABSCO SUMMARY
Package decisions made in place.
Choosing a dependency normally means leaving the editor for four tabs: npm, GitHub, a CVE database, the changelog. All four answers are one call each here, which is what makes the comparison actually happen instead of getting skipped.
What it is
An MCP server over the npm registry, covering package discovery, version history, download statistics, vulnerability checks, side-by-side comparison, changelogs, dependents and READMEs.
What you get
- Packages searched by keyword, with quality and maintenance scores
- Full package details: description, latest version, license, maintainers, repository and dependencies
- Every published version with its publish date
- Download statistics over a period you choose
- Known vulnerabilities for one specific version
- Two packages compared side by side on downloads, maintenance, quality and dependencies
- Release notes between two versions, falling back to CHANGELOG.md
- Packages that depend on a given package, ranked by popularity
- The full README of any package
Requirements
Node.js v18 or higher. npx handles the rest — nothing to clone or build, and no key.
Setup effort
One command — npx mcp-npm-registry
USE CASES
01
Choosing between two libraries
Compare them side by side on downloads, maintenance, quality and dependencies.
02
Checking whether a package is still alive
Read its version history with publish dates alongside its download trend.
03
Auditing a pinned version before an upgrade
Check the known CVEs for exactly that version.
04
Working out what a major bump will break
Read the release notes between the two versions.
05
Learning how to use a package you just added
Pull its full README into the conversation.
06
Gauging how load-bearing a package is
List the packages depending on it, ranked by popularity.
9 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
compare_packages
Compare two npm packages side by side: downloads, maintenance, quality, dependencies and more.
get_changelog
Get release notes for an npm package. Optionally filter between two versions. Falls back to CHANGELOG.md if no GitHub releases exist.
get_dependents
Find packages that depend on a given npm package, ranked by popularity. Shows total dependent count and top dependents.
get_download_stats
Get download statistics for an npm package over a given period.
get_package_info
Get detailed info about an npm package: description, latest version, license, maintainers, repository, dependencies and more.
get_package_readme
Fetch the full README of an npm package. Useful for understanding how to install, configure and use a package.
get_package_versions
List all published versions of an npm package with their publish dates.
search_packages
Search for npm packages by keyword. Returns name, description, version, downloads and quality score.
BEFORE YOU INSTALL
What to know first
Tools you get
9 tools when we connected. get_dependents is undocumented. All nine only read, and no API key is needed.
Requires
npx on PATH
Where it runs
The documented client runs the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 9 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx mcp-npm-registryMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"npm-registry": {
"command": "npx",
"args": [
"mcp-npm-registry"
]
}
}
}
