49 tools that work with npm: 35 MCP servers, 14 Agent Skills and 0 Claude Code plugins. 9 of the remote servers answered our live check, 3 worked without an API key, and 9 come from an official or verified publisher. Ranked by GitHub stars plus official, live and free-to-try signals.
Most common uses: Code search, analysis, refactoring & languages (26), Code & dependency scanning (6), Git hosting, PRs, issues & code review (5), Hosting & deployment (4).
| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| get-unpublished-changes Compare HEAD with the latest published npm versions and list all unpublished changes by release layer. Triggers: unpublished changes, changelog, what SkillInstall · skills CLI | 70,897 | — | ||
| pre-publish-review Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrai SkillInstall · skills CLI | 70,897 | — | ||
| detecting-dependency-confusion Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal packag SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-malicious-npm-packages Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-typosquatting-packages Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proxim SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| detecting-typosquatting-packages-in-npm-pypi Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metr SkillInstall · skills CLI | 36,105 | Apache-2.0 | ||
| antfu Anthony Fu's opinionated tooling and conventions for JavaScript/TypeScript projects. Use when setting up new projects, configuring ESLint/Prettier alt SkillInstall · skills CLI | 6,067 | MIT | ||
| Package Health Check Check an npm or Python package, or a package.json, for vulnerabilities and upkeep. MCP serverVerified domain · openkrill.appRemote● LiveFree to try | 1 | MIT | ||
| release Release procedure for agent-skills-vrc-udon: sync main into dev, bump the five version fields, open and merge the release PR, rewrite the Release Draf SkillInstall · skills CLI | 368 | MIT | ||
| generate-package-skill Generate or update an Agent Skill that teaches consumers one npm or local package the user maintains, including framework modules and wrappers. Tests SkillInstall · skills CLI | 331 | MIT | ||
| update-package-skill Updates an existing package Skill for a new release of its npm or local package by testing only what changed since the version the Skill names. Use wh SkillInstall · skills CLI | 331 | MIT | ||
| npm-package-dev Use when user says "npm package", "publish npm", "create package", "package.json", "npm registry". Create, publish, and maintain NPM packages with cor SkillInstall · skills CLI | 330 | — | ||
| autoship Runs a changesets npm release through the version PR, CI publish, and registry verification. Use when asked to "release this package", "autoship", "me SkillInstall · skills CLI | 201 | MIT | ||
| publish-release Release moi-computer to npm — verify locally, hand off to the gated GitHub Actions workflow, then verify the published package. Defaults to a `next` p SkillInstall · skills CLI | 201 | — | ||
| DefaultRank Check npm dependencies for outdated majors, and see which dev tools AI models pick. MCP serverVerified domain · defaultrank.comRemote● LiveAPI key needed | — | — | ||
| Notary Check npm and PyPI packages exist before install: versions, age, downloads, look-alikes. MCP serverVerified domain · clawhard.comRemote● Live | — | — | ||
| npm Release Tracker — new Node.js packages & JavaScript dependency updates (npmwatch) npm releases: Node package versions, daily. $0.01/query. Be born in one call — free testnet funds. MCP serverVerified domain · a2awire.comRemote● LiveAPI key needed | — | — | ||
| Ripedeps Deterministic package.json upgrade plans: age gate, aligned peers, reasons per change. No AI. MCP serverVerified domain · ripedeps.comRemote● Live | — | — | ||
| SemverKit Semver parse, compare, npm range checks, max-satisfying and version bumps (node-semver compatible). MCP serverVerified domain · semverkit.mike-tusa.workers.devRemote● Live | — | — | ||
| io.github.Dave-London/npm Structured npm/pnpm operations (install, audit, outdated, list) as typed JSON. MCP serverGitHub-verified authorLocal · npm | 141 | MIT | ||
| io.github.Dave-London/pare-npm Pare npm ג€” Structured npm/pnpm operations (install, audit, outdated, list, run) as typed JSON. MCP serverGitHub-verified authorLocal · npm | 141 | MIT | ||
| npm-release Use when publishing or preparing to publish an npm package from any repository, when asked whether a package is ready to publish, or when npm publish SkillInstall · skills CLI | 126 | MIT | ||
| stalemap Tells coding agents which npm dependencies changed after their training cutoff, and what changed. MCP serverGitHub-verified authorLocal · npm | 110 | MIT | ||
| CompatLab Read recorded npm loading evidence across pinned Node.js, Bun and Deno runtimes. MCP serverGitHub-verified authorRemote● LiveFree to try | 4 | MIT | ||
| lurq Verify npm packages before your AI agent installs them: hallucinations, advisories, API drift. MCP serverGitHub-verified authorRemote● LiveAPI key needed | 8 | MIT | ||
| UNPKG Live npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks. MCP serverGitHub-verified authorRemote● LiveFree to try | 1 | MIT | ||
| Attestari Attestari's verdict on an npm or PyPI package version, asked before an agent installs it. MCP serverVerified domain · attestari.aiLocal · PyPI | — | — | ||
| com.edgethirteen.www/pumpcheck Detect npm download-pumping before adding a dependency: real usage vs inflated counter. MCP serverVerified domain · www.edgethirteen.comRemoteDown | — | — | ||
| Greenflagged Ask whether npm packages are reviewed and greenflagged, audit a package.json, and request imports. MCP serverVerified domain · greenflagged.devRemoteSign-in needed | — | — | ||
| io.github.FlorianBruniaux/dep-scope Symbol-level npm dependency analysis: scan verdicts, native alternatives, migration prompts. MCP serverGitHub-verified authorLocal · npm | 19 | MIT | ||
| io.github.Nekzus/npm-sentinel-mcp Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights. MCP serverGitHub-verified authorLocal · npm | 18 | MIT | ||
| pkgxray Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence. MCP serverGitHub-verified authorLocal · npm | 12 | MIT | ||
| npm Registry MCP Server npm registry MCP server — package intelligence, security audits, dependency analysis MCP serverGitHub-verified authorLocal · npm | 5 | MIT | ||
| io.github.alisaitteke/npm-mcp MCP server for npm package management, security analysis, and compatibility checking MCP serverGitHub-verified authorLocal · npm | 3 | MIT | ||
| io.github.fstubner/npm-run-mcp-server An MCP server that exposes package.json scripts as tools for agents. MCP serverGitHub-verified authorLocal · npm | 3 | MIT | ||
| io.github.jmshinhwa/npm-trusted-publish-lint Finds the credential in your release workflow that expires before your next release MCP serverGitHub-verified authorLocal · npm | 1 | — | ||
| io.github.mikusnuz/npm MCP server for npm package management — publish, version, search, audit, and more MCP serverGitHub-verified authorLocal · npm | 1 | MIT | ||
| io.github.ofershap/npm-plus npm MCP — search packages, bundle sizes, vulnerabilities, compare downloads. MCP serverGitHub-verified authorLocal · npm | 1 | MIT | ||
| Packkit Scaffold modern npm packages, CLIs, services and apps as a native tool for AI agents. MCP serverGitHub-verified authorLocal · npm | 1 | MIT | ||
| io.github.bighippoman/license-compliance Scan npm dependencies for license compliance issues. Catch GPL contamination. MCP serverGitHub-verified authorLocal · npm | 0 | MIT | ||
| io.github.mcurmi05/vdiff-mcp Breaking-change diffs for npm packages: removed exports, changed signatures, migration notes. MCP serverGitHub-verified authorLocal · npm | 0 | — | ||
| io.github.ofershap/npm-search npm search MCP — find packages, view details, compare, check downloads. MCP serverGitHub-verified authorLocal · npm | 0 | MIT | ||
| io.github.orcar-studio/fascia-mcp-server Expose Fascia-deployed Tools and Entity schemas to AI agents via MCP MCP serverGitHub-verified authorLocal · npm | — | — | ||
| io.github.TweedBeetle/dependency-fitness-mcp npm dependency fitness: deprecated/yanked/superseded + verified safe migration target. MCP serverGitHub-verified authorLocal · npm | 0 | MIT | ||
| io.github.YashviGupta15/npm-advisor-mcp MCP server to search, compare, and recommend npm packages by size, popularity, and maintenance. MCP serverGitHub-verified authorLocal · npm | 0 | — | ||
| io.github.zcag/npm-search-mcp Search npm packages, get live registry data, and compare alternatives. No API key needed. MCP serverGitHub-verified authorLocal · Docker | 0 | MIT | ||
| MCP Dependency Doctor Read-only npm dependency diagnostics for AI coding agents. MCP serverGitHub-verified authorLocal · npm | 0 | MIT | ||
| npm Package Metadata — Versions, Licenses & Counts Read latest npm package versions, license tokens and dependency counts MCP serverGitHub-verified authorRemoteSign-in needed | — | — | ||
| npm Supply Chain Audit Check npm packages for typosquats, hallucinated names, install scripts and risky new releases. MCP serverGitHub-verified authorRemoteSign-in needed | 0 | MIT |