{"apiVersion":"v1","directorySlug":"npmscan-mcp-7214f2b548","title":"NPMScan","description":"Protect your Node.js projects from supply chain attacks. Scan npm packages for malware, crypto-drainers, and security vulnerabilities. Real-time threat intelligence database tracking malicious packages.","pageUrl":"https://www.mcpbundles.com/skills/npmscan-mcp-7214f2b548","connectPath":"importable","connectAction":"import_server","catalogListing":false,"bundleSlug":null,"listingKind":"remote_mcp","kind":"provider","transportUrl":"https://npmscan.com/api/mcp","hostedMcpUrl":null,"toolCount":23,"toolInventoryStatus":"observed","refreshedAt":"2026-11-03T13:26:00.516172+00:00","registryName":"com.npmscan/npmscan-mcp-7214f2b548","registryVersion":"2026.11.3","registryEligible":true,"tools":[{"name":"search_packages","description":"Search the npm registry by name or keywords. Each result includes its current weekly/monthly download counts, dependentsCount (how many other npm packages depend on it), topPackagesRank (position among npmscan's own top-100k-by-downloads snapshot — not live, but a second independent popularity signal), and deterministic (not model-generated) popularityTier/maintenanceTier labels — a package matching the query with a 'very-low' popularityTier, zero dependents, or a 'stale' maintenanceTier is very","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["query"],"properties":{"limit":{"type":"integer","maximum":50,"minimum":1},"query":{"type":"string","maxLength":64,"minLength":2}},"additionalProperties":false},"title":"Search npm packages","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"search_packages","displayName":"Search npm packages"},{"name":"get_package","description":"Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, recent version history, weekly downloads, GitHub stars, TypeScript support, days since last publish, a topPackagesRank (position among npm's ~100k most-downloaded packages, from npmscan's own periodically-refreshed snapshot — not live), and a downloadTrend (growing/stable/declining vs. ~3 months ago). Also checks the LATEST version against OSV.dev for k","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1}},"additionalProperties":false},"title":"Get npm package details","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_package","displayName":"Get npm package details"},{"name":"get_package_version","description":"Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball) AND check that exact version against OSV.dev for known vulnerabilities — isVulnerable/highestSeverity give a direct answer, and each finding includes severity, a summary, and the fixedVersion to upgrade to. Use this to check a version pinned in a lockfile rather than the latest release. If the OSV.dev query itself fails (network/timeout/upstream outage), isVulnerable comes back `false` only becaus","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name","version"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128,"minLength":1}},"additionalProperties":false},"title":"Get a specific npm package version","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_package_version","displayName":"Get a specific npm package version"},{"name":"get_maintainer_profile","description":"Given an npm username, returns every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search — the public registry API has no dedicated 'list packages by maintainer' endpoint otherwise), plus precomputed aggregates: currentlyMaintainsCount (still listed as maintainer right now vs. already-revoked), totalWeeklyDownloads and totalDependents summed across every returned package, and avatarUrl — the same Gravatar image npmjs.com's ow","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["maintainerUsername"],"properties":{"maintainerUsername":{"type":"string","maxLength":100,"minLength":1}},"additionalProperties":false},"title":"Get basic profile info for an npm maintainer","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_maintainer_profile","displayName":"Get basic profile info for an npm maintainer"},{"name":"query_vulnerabilities","description":"Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile is safe). Returns isVulnerable and highestSeverity as a direct answer, plus each finding's severity, a plain-language summary, CVE aliases, and the fixedVersion to upgrade to — not a raw advisory dump. Also cross-checks the name/version against the npm registry: isVulnerable:false on a package that does not actually exist there (typo, wron","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128},"ecosystem":{"type":"string","maxLength":32}},"additionalProperties":false},"title":"Query known vulnerabilities for a package","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"query_vulnerabilities","displayName":"Query known vulnerabilities for a package"},{"name":"batch_query_vulnerabilities","description":"Query OSV.dev for known vulnerabilities across a whole npm dependency inventory at once: either pass a flat {packages:[...]} list, or paste raw package.json / lockfile / CycloneDX JSON / SPDX JSON content via `content`. The tool normalizes npm dependencies first, then chunk-queries OSV behind the scenes so large SBOMs don't stop at the upstream 100-package batch limit. Each finding includes severity, a summary, CVE aliases, and the fixed version — not just a bare advisory ID — so a dependency au","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"content":{"type":"string","minLength":1},"packages":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128}},"additionalProperties":false},"maxItems":1000,"minItems":1},"includeDevDependencies":{"type":"boolean"},"includePeerDependencies":{"type":"boolean"}},"additionalProperties":false},"title":"Batch query known vulnerabilities","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"batch_query_vulnerabilities","displayName":"Batch query known vulnerabilities"},{"name":"get_latest_advisories","description":"Browse recently published npm security advisories and known-malicious-package findings. Three disjoint sources, selected via type: \"reviewed\" (default) is GitHub's curated, mostly CVE-backed advisories; \"malware\" is GitHub's own known-malicious-package advisories; \"osv\" is OSV.dev's OpenSSF malicious-packages feed, which covers far more malicious npm packages than GitHub ever republishes under a GHSA id. None of \"malware\"/\"osv\" carry a CVE or meaningful CWE beyond \"embedded malicious code\". Filt","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"type":{"enum":["reviewed","malware","osv"],"type":"string"},"cveId":{"type":"string"},"cursor":{"type":"string"},"ghsaId":{"type":"string"},"affects":{"type":"string","maxLength":214},"category":{"enum":["access-control","dos","xss","ssrf","auth","code-injection","info-exposure","path-traversal","input-validation","prototype-pollution","command-injection","sqli","crypto","race-condition","open-redirect","csrf","crlf-injection","xml-injection","malicious-code","deserialization"],"type":"string"},"severity":{"enum":["critical","high","medium","low","all"],"type":"string"},"direction":{"enum":["asc","desc"],"type":"string"}},"additionalProperties":false},"title":"Get latest npm security advisories","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_latest_advisories","displayName":"Get latest npm security advisories"},{"name":"get_cve","description":"Look up authoritative NIST NVD data for one exact CVE ID (e.g. \"CVE-2026-2950\"), or browse/search NVD by keyword, CVSS severity, CWE, or a publication-date range. Every result is enriched with CISA KEV status (`kev`, non-null only if this CVE is a confirmed, actively-exploited-in-the-wild vulnerability — treat that as an urgent-patch signal regardless of CVSS score) and FIRST.org EPSS (`epss`, the probability of exploitation in the next 30 days — a better prioritization signal than CVSS severity","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"cveId":{"type":"string","pattern":"^CVE-\\d{4}-\\d{4,}$"},"cweId":{"type":"string","pattern":"^CWE-\\d+$"},"severity":{"enum":["CRITICAL","HIGH","MEDIUM","LOW"],"type":"string"},"startIndex":{"type":"integer","minimum":0},"keywordSearch":{"type":"string","maxLength":200,"minLength":1},"publishedSince":{"type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}$"},"publishedUntil":{"$ref":"#/properties/publishedSince"},"resultsPerPage":{"type":"integer","maximum":50,"minimum":1}},"additionalProperties":false},"title":"Look up a CVE in the NIST NVD","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_cve","displayName":"Look up a CVE in the NIST NVD"},{"name":"analyze_install_script","description":"Statically scans a package's preinstall/install/postinstall/prepare lifecycle scripts AND the file(s) they reference — fetched directly from the published tarball, not just the command string in package.json — against npmscan's documented red-flags rubric (/docs/red-flags): child_process use, network calls, access to sensitive paths/env (.ssh, .aws, .npmrc, *TOKEN/*KEY), obfuscation, remote binaries hosted off trusted CDNs, writes to HOME, Discord/Telegram/Pastebin exfil endpoints, eval on decod","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128,"minLength":1}},"additionalProperties":false},"title":"Analyze an npm package install script","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"analyze_install_script","displayName":"Analyze an npm package install script"},{"name":"analyze_transitive_dependencies","description":"Recursively resolves one or more direct/root packages' dependency graphs — e.g. the \"dependencies\" section of a package.json — up to maxDepth levels deep (default 2, max 3) and batch-checks every resolved package@version against OSV.dev, so vulnerabilities buried several levels down (which would never show up from checking direct dependencies alone) still surface. `summary` is a one-sentence, deterministic recap (packages scanned, unresolved count, vulnerable count and which roots pulled them in","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["packages"],"properties":{"maxDepth":{"type":"integer","maximum":3,"minimum":0},"packages":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128}},"additionalProperties":false},"maxItems":15,"minItems":1}},"additionalProperties":false},"title":"Analyze transitive dependencies for vulnerabilities","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"analyze_transitive_dependencies","displayName":"Analyze transitive dependencies for vulnerabilities"},{"name":"check_package_provenance","description":"Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128,"minLength":1}},"additionalProperties":false},"title":"Check an npm package version for publish-provenance red flags","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"check_package_provenance","displayName":"Check an npm package version for publish-provenance red flags"},{"name":"check_maintainer_changes","description":"Reconstructs a package's maintainer-change history straight from the npm packument — every published version carries the maintainers-list SNAPSHOT as it stood at that publish plus who actually ran `npm publish` (`_npmUser`), so diffing consecutive snapshots in publish-time order recovers exactly who was added or removed and when, with no extra API calls. Flags: (1) a maintainer added recently who then published a release shortly afterward on a package with real prior history — the account-takeov","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1}},"additionalProperties":false},"title":"Check an npm package for maintainer/ownership red flags","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"check_maintainer_changes","displayName":"Check an npm package for maintainer/ownership red flags"},{"name":"check_maintainer_blast_radius","description":"Given an npm username, finds every package npm's own maintainer:<username> search index currently returns for that account (registry.npmjs.org's /-/v1/search — the same reverse lookup npmjs.com's own site search uses; the public registry API has no dedicated 'list packages by maintainer' endpoint otherwise) and looks for a tight cluster of packages whose LATEST version was published within a short rolling window of each other. That's the shape of a compromised-account supply-chain attack: a stol","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["maintainerUsername"],"properties":{"maintainerUsername":{"type":"string","maxLength":100,"minLength":1}},"additionalProperties":false},"title":"Find every package an npm maintainer account touches, and flag a tight publish cluster","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"check_maintainer_blast_radius","displayName":"Find every package an npm maintainer account touches, and flag a tight publish cluster"},{"name":"check_license_compliance","description":"Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json \"dependencies\" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and understands simple SPDX expressions: \"(MIT OR GPL-3.0)\" is compliant if EITHER side is permitted (a consume","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["packages"],"properties":{"policy":{"type":"object","properties":{"deny":{"type":"array","items":{"type":"string","maxLength":100,"minLength":1},"maxItems":50},"allow":{"type":"array","items":{"type":"string","maxLength":100,"minLength":1},"maxItems":50}},"additionalProperties":false},"packages":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128}},"additionalProperties":false},"maxItems":100,"minItems":1}},"additionalProperties":false},"title":"Check a dependency list against a license policy","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"check_license_compliance","displayName":"Check a dependency list against a license policy"},{"name":"diff_dependencies","description":"Compares two raw snapshots of a package.json, package-lock.json (npm v1-v3), yarn.lock (classic v1 or Berry), or pnpm-lock.yaml — e.g. before/after a PR — and reports which packages were added, removed, or version-bumped. An npm alias (e.g. `\"totally-safe\": \"npm:minimist@0.0.8\"`) is followed to its real target in every format — `actualName` names the real package that vulnerability/install-script data attaches to (`name` stays the declared/alias key); this is NOT silently skipped, since doing so","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["before","after"],"properties":{"after":{"type":"string","maxLength":8388608,"minLength":1},"before":{"type":"string","maxLength":8388608,"minLength":1}},"additionalProperties":false},"title":"Diff two package.json/lockfile snapshots","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"diff_dependencies","displayName":"Diff two package.json/lockfile snapshots"},{"name":"prioritize_remediation","description":"Given a batch of vulnerability findings already flagged elsewhere (e.g. from batch_query_vulnerabilities, analyze_transitive_dependencies, or query_vulnerabilities across a whole package.json/lockfile audit), ranks them by what to actually fix first. Combines CISA KEV status (confirmed active exploitation in the wild — an automatic top-priority override), FIRST.org EPSS (probability of exploitation in the next 30 days — the primary ranking signal, since it measures likelihood rather than just im","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["findings"],"properties":{"findings":{"type":"array","items":{"type":"object","required":["packageName"],"properties":{"cveId":{"type":"string","pattern":"^CVE-\\d{4}-\\d{4,}$"},"severity":{"type":"string","maxLength":32},"advisoryId":{"type":"string","maxLength":64},"findingType":{"enum":["malware","vulnerability","supply-chain","install-script"],"type":"string"},"packageName":{"type":"string","maxLength":214,"minLength":1},"fixedVersion":{"type":"string","maxLength":128},"currentVersion":{"type":"string","maxLength":128}},"additionalProperties":false},"maxItems":200,"minItems":1}},"additionalProperties":false},"title":"Rank a batch of flagged vulnerabilities by what to fix first","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"prioritize_remediation","displayName":"Rank a batch of flagged vulnerabilities by what to fix first"},{"name":"simulate_dependency_upgrade","description":"Given a package and a current/target version, tells you whether that specific upgrade is a safe patch/minor bump or a likely-breaking major bump, before you actually run npm install. Natural follow-up to prioritize_remediation: pass its `packageName` + `currentVersion` + `fixedVersion` straight in to check whether the suggested fix is a drop-in patch or something that needs a review pass. Classifies the jump by semver (major/minor/patch/prerelease), treats a minor bump between two pre-1.0 (0.x)","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"packages":{"type":"array","items":{"type":"object","required":["packageName","currentVersion"],"properties":{"packageName":{"type":"string","maxLength":214,"minLength":1},"targetVersion":{"type":"string","maxLength":128,"minLength":1},"currentVersion":{"type":"string","maxLength":128,"minLength":1}},"additionalProperties":false},"maxItems":100,"minItems":1},"packageName":{"type":"string","maxLength":214,"minLength":1},"targetVersion":{"type":"string","maxLength":128,"minLength":1},"currentVersion":{"type":"string","maxLength":128,"minLength":1}},"additionalProperties":false},"title":"Simulate upgrading one package from one version to another, or a whole batch at once","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"simulate_dependency_upgrade","displayName":"Simulate upgrading one package from one version to another, or a whole batch at once"},{"name":"suggest_alternative","description":"Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks the source package's own latest-version health (deprecation, latest-version OSV verdict, popularity/maintenance tiers, typosquat flag), then combines maintainer-provided deprecation hints with deterministic npm search-based category matching. It ranks candidates using category overlap plus search_packages-style popularity/maintenance sig","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"limit":{"type":"integer","maximum":10,"minimum":1},"reason":{"enum":["deprecated","vulnerable","abandoned","typosquat","general"],"type":"string"}},"additionalProperties":false},"title":"Suggest better-maintained npm alternatives","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"suggest_alternative","displayName":"Suggest better-maintained npm alternatives"},{"name":"compare_packages","description":"Given 2-5 candidate packages for the same job (e.g. \"axios vs got vs node-fetch\"), fetches the same registry/popularity/maintenance/vulnerability enrichment get_package computes for each one in parallel and returns a structured side-by-side plus a deterministic, reasoned pick. Each candidate gets downloads + trend, popularityTier/maintenanceTier, GitHub stars, TypeScript support, license, deprecated status, latest-version vulnerability status, a lightweight installScriptRisk signal (scans lifecy","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["packages"],"properties":{"packages":{"type":"array","items":{"type":"string","maxLength":214,"minLength":1},"maxItems":5,"minItems":2}},"additionalProperties":false},"title":"Compare npm packages side-by-side","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"compare_packages","displayName":"Compare npm packages side-by-side"},{"name":"audit_github_repository","description":"Given a GitHub repository URL, fetches its package.json (and, if present, a pnpm-lock.yaml/package-lock.json/yarn.lock — first one found wins, in that priority order) straight from the repo's default branch and runs the same vulnerability, license-compliance, install-script, and ownership-risk pipelines batch_query_vulnerabilities/check_license_compliance/analyze_install_script/check_maintainer_changes/check_package_provenance expose individually, in one call — no copy-pasting file contents requ","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["url"],"properties":{"ref":{"type":"string","maxLength":250,"minLength":1},"url":{"type":"string","maxLength":500,"minLength":1},"policy":{"type":"object","properties":{"deny":{"type":"array","items":{"type":"string","maxLength":100,"minLength":1},"maxItems":50},"allow":{"type":"array","items":{"type":"string","maxLength":100,"minLength":1},"maxItems":50}},"additionalProperties":false},"includeDevDependencies":{"type":"boolean"},"includePeerDependencies":{"type":"boolean"}},"additionalProperties":false},"title":"Audit a GitHub repository's npm dependencies","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"audit_github_repository","displayName":"Audit a GitHub repository's npm dependencies"},{"name":"get_remediation_playbook","description":"Maps a finding's `rule` value from analyze_install_script, check_maintainer_changes, or check_package_provenance to the matching human-authored incident-response playbook (the same content published at /docs/playbooks) and returns its concrete, ordered steps, severity tier, real-incident references, and prevention tips — not just a link. Pass the exact `rule` string(s) a prior finding already returned (batch up to 10 in one call to cover a whole findings array; duplicates resolving to the same p","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"id":{"type":"string","maxLength":64,"minLength":1},"rules":{"type":"array","items":{"type":"string","maxLength":64,"minLength":1},"maxItems":10,"minItems":1}},"additionalProperties":false},"title":"Get the concrete remediation playbook for a flagged finding","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"get_remediation_playbook","displayName":"Get the concrete remediation playbook for a flagged finding"},{"name":"generate_sbom","description":"Given the same inputs batch_query_vulnerabilities accepts — either a flat {packages:[...]} list, or raw package.json / lockfile / CycloneDX JSON / SPDX JSON content via `content` — emits a spec-valid CycloneDX 1.6 or SPDX 2.3 JSON document (pick with `format`, default 'cyclonedx') with npmscan's own OSV.dev vulnerability findings and registry license data embedded in each spec's native fields: CycloneDX gets a top-level `vulnerabilities[]` array (VEX `analysis.state: 'in_triage'` — an unreviewed","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","properties":{"format":{"enum":["cyclonedx","spdx"],"type":"string"},"policy":{"type":"object","properties":{"deny":{"type":"array","items":{"type":"string","maxLength":100,"minLength":1},"maxItems":50},"allow":{"type":"array","items":{"type":"string","maxLength":100,"minLength":1},"maxItems":50}},"additionalProperties":false},"content":{"type":"string","minLength":1},"packages":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":214,"minLength":1},"version":{"type":"string","maxLength":128}},"additionalProperties":false},"maxItems":1000,"minItems":1},"componentName":{"type":"string","maxLength":214,"minLength":1},"includeLicenses":{"type":"boolean"},"componentVersion":{"type":"string","maxLength":128,"minLength":1},"includeDevDependencies":{"type":"boolean"},"includeVulnerabilities":{"type":"boolean"},"includePeerDependencies":{"type":"boolean"}},"additionalProperties":false},"title":"Generate a CycloneDX or SPDX SBOM","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"generate_sbom","displayName":"Generate a CycloneDX or SPDX SBOM"},{"name":"enrich_npm_audit","description":"Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists. npm audit's JSON almost never includes a CVE id (only a GHSA advisory URL), so this resolves each GHSA to its CVE alias via OSV.dev when one exists (ghsaResolve","inputSchema":{"type":"object","$schema":"http://json-schema.org/draft-07/schema#","required":["content"],"properties":{"content":{"type":"string","minLength":1}},"additionalProperties":false},"title":"Rank raw `npm audit --json` output by what to fix first","annotations":{"readOnlyHint":true,"untrustedContentHint":true},"logicalName":"enrich_npm_audit","displayName":"Rank raw `npm audit --json` output by what to fix first"}],"toolSource":"directory_preview","agentAction":"both","installLinks":[{"id":"cursor","label":"Cursor","href":"cursor://anysphere.cursor-deeplink/mcp/install?name=NPMScan&config=eyJ1cmwiOiAiaHR0cHM6Ly9ucG1zY2FuLmNvbS9hcGkvbWNwIn0%3D"},{"id":"vscode","label":"VS Code","href":"vscode:mcp/install?%7B%22name%22%3A%22NPMScan%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fnpmscan.com%2Fapi%2Fmcp%22%7D"},{"id":"vscode-insiders","label":"VS Code Insiders","href":"vscode-insiders:mcp/install?%7B%22name%22%3A%22NPMScan%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fnpmscan.com%2Fapi%2Fmcp%22%7D"},{"id":"claude-web","label":"Claude.ai","href":"https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=NPMScan&connectorUrl=https%3A%2F%2Fnpmscan.com%2Fapi%2Fmcp"},{"id":"codex","label":"Codex","copyText":"codex mcp add \"NPMScan\" --url \"https://npmscan.com/api/mcp\""},{"id":"chatgpt","label":"ChatGPT","href":"https://www.mcpbundles.com/docs/integrations/chatgpt"}],"catalogUrl":"https://www.mcpbundles.com/api/directory/v1/servers/npmscan-mcp-7214f2b548","callUrl":"https://www.mcpbundles.com/api/directory/v1/servers/npmscan-mcp-7214f2b548/tools/{tool}","mcpServerUrl":"https://npmscan.com/api/mcp","liveCatalogUrl":"https://www.mcpbundles.com/api/directory/v1/servers/npmscan-mcp-7214f2b548?live=1"}