@mikusnuz/npm-mcp

MCPcommunity
v1.3.0plumbugMITUpdated 5d agonpmGitHub

MCP server for npm package management — publish, version, search, audit, and more from your AI assistant

Works in
ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
198Downloads/wk
1GitHub stars
5d agoLast update
Reads these credentials
  • NPM_TOKENAPI keyoptional

    npm granular access token; stage-only tokens use the stage tool

Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.

Package
Authorplumbug
LicenseMIT
Version1.3.0
Sourcenpm+mcp-registry
npm@mikusnuz/npm-mcp
GitHubmikusnuz/npm-mcp
SBOMCycloneDX 1.6 ↓
Trust Status
B
60/100Good
✓Listed in Forge index+10/10
—Publisher identity verified+0/20
→ Publisher: run `forge publish` from the package repo to claim ownership
—Ed25519 publish signature+0/5
→ Included automatically when the publisher runs `forge publish`
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
—npm Trusted Publishing (Sigstore)+0/5
→ Publish from GitHub Actions with --provenance so the attestation binds this package to this repo
—npm maintainer match+0/5
→ Earned once your identity is verified above and that login is an npm maintainer of this package
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain—
Provenance—
Dependencies✓ 60 resolved+ · none vulnerable
Tool surface39 tools · 1 privileged
Security scan✓ Cleanv1.3.0 · todayHow well does this scan work?
EvalsNone
IndexedOct 11, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

39 tools · 1 privileged
Statically extracted from the published packagev1.3.0 · 7h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

publishPublish a package to the npm registry

Publish a package to the npm registry

No input schema was published for this tool.

stageStage a package, inspect pending versions, download a tarball, or approve/reject a stage. Approval publishes the version; rejection removes the staged version. Requires an npm CLI supporting npm stage.

Stage a package, inspect pending versions, download a tarball, or approve/reject a stage. Approval publishes the version; rejection removes the staged version. Requires an npm CLI supporting npm stage.

No input schema was published for this tool.

versionBump the package version

Bump the package version

No input schema was published for this tool.

viewView package information from the registry

View package information from the registry

No input schema was published for this tool.

searchSearch npm registry for packages

Search npm registry for packages

No input schema was published for this tool.

unpublishRemove a package version from the registry

Remove a package version from the registry

No input schema was published for this tool.

deprecateDeprecate a version of a package

Deprecate a version of a package

No input schema was published for this tool.

ownerManage package owners

Manage package owners

No input schema was published for this tool.

dist-tagManage distribution tags

Manage distribution tags

No input schema was published for this tool.

packCreate a tarball from a package (preview what would be published)

Create a tarball from a package (preview what would be published)

No input schema was published for this tool.

whoamiCheck which npm user is currently authenticated. If not logged in, set NPM_TOKEN env var in MCP config.

Check which npm user is currently authenticated. If not logged in, set NPM_TOKEN env var in MCP config.

No input schema was published for this tool.

initInitialize a new package.json

Initialize a new package.json

No input schema was published for this tool.

auditRun a security audit on the package

Run a security audit on the package

No input schema was published for this tool.

outdatedCheck for outdated packages in a project

Check for outdated packages in a project

No input schema was published for this tool.

lsList installed packages in a project

List installed packages in a project

No input schema was published for this tool.

installprivilegedInstall packages in a project

Install packages in a project

No input schema was published for this tool.

uninstallRemove packages from a project

Remove packages from a project

No input schema was published for this tool.

updateUpdate packages in a project to their latest semver-compatible version

Update packages in a project to their latest semver-compatible version

No input schema was published for this tool.

accessSet or view access level on published packages

Set or view access level on published packages

No input schema was published for this tool.

tokenManage npm access tokens (list or revoke)

Manage npm access tokens (list or revoke)

No input schema was published for this tool.

pingCheck connectivity to the npm registry

Check connectivity to the npm registry

No input schema was published for this tool.

bugsGet the bug tracker URL for a package

Get the bug tracker URL for a package

No input schema was published for this tool.

repoGet the repository URL for a package

Get the repository URL for a package

No input schema was published for this tool.

docsGet the documentation URL for a package

Get the documentation URL for a package

No input schema was published for this tool.

diffShow diff between package versions or between local and registry

Show diff between package versions or between local and registry

No input schema was published for this tool.

pkgManage package.json fields programmatically

Manage package.json fields programmatically

No input schema was published for this tool.

fundShow funding information for installed packages

Show funding information for installed packages

No input schema was published for this tool.

dedupeReduce duplication in the dependency tree

Reduce duplication in the dependency tree

No input schema was published for this tool.

explainExplain why a package is installed (show dependency chain)

Explain why a package is installed (show dependency chain)

No input schema was published for this tool.

sbomGenerate a Software Bill of Materials (SBOM) for a project

Generate a Software Bill of Materials (SBOM) for a project

No input schema was published for this tool.

profileView or modify npm user profile settings

View or modify npm user profile settings

No input schema was published for this tool.

ciClean install dependencies from lockfile (for CI environments)

Clean install dependencies from lockfile (for CI environments)

No input schema was published for this tool.

run-scriptRun a script defined in package.json

Run a script defined in package.json

No input schema was published for this tool.

doctorRun diagnostics to check npm environment health

Run diagnostics to check npm environment health

No input schema was published for this tool.

cacheManage the npm cache

Manage the npm cache

No input schema was published for this tool.

configView npm configuration (read-only for safety)

View npm configuration (read-only for safety)

No input schema was published for this tool.

pruneRemove extraneous packages not listed in package.json

Remove extraneous packages not listed in package.json

No input schema was published for this tool.

linkSymlink a local package for development

Symlink a local package for development

No input schema was published for this tool.

queryQuery installed packages using CSS-like selectors

Query installed packages using CSS-like selectors

No input schema was published for this tool.

39 of 39 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

MCP server for npm package management — publish, version, search, audit, and more from your AI assistant

Keywords
mcpnpmpackage-managementmodel-context-protocolpublishregistry
Alternatives
Comparing tool surfaces…

Tools exposed

39 tools · 1 privileged · observed by static extraction. A tool surface is what one scan read on one day, not a live capability list.

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-13 — observed resolution, not a publisher declaration.

60 packages resolved · 2 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

The crawl stopped at the depth-4 limit. Anything below that level was never resolved.

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

55 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

+43 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.