Npm Sentinel

Npm Sentinel

What is Npm Sentinel about?

Npm Sentinel delivers real‑time, AI‑driven intelligence for NPM packages. It exposes a set of MCP tools that can fetch versions, dependencies, TypeScript support, package size, security advisories, download trends, quality scores and many other metrics, allowing developers to make faster, safer package‑management decisions.

How to use Npm Sentinel?

1. Run via NPX (recommended):

   {
     "mcpServers": {
       "npm-sentinel": {
         "command": "npx",
         "args": ["-y", "@nekzus/mcp-server@latest"]
       }
     }
   }
   

   Add the above snippet to your VS Code settings.json under mcpServers or to a Claude Desktop config file.
2. Docker: Build the image (docker build -t nekzus/npm-sentinel-mcp .) and run it with the provided mount arguments.
3. Smithery.ai: Deploy the HTTP‑streamable version by pointing to https://smithery.ai/server/@Nekzus/npm-sentinel-mcp in the MCP configuration.
4. Local development: npm run dev for a playground, npm run build:http then npm run start:http for the HTTP server.

Key features of Npm Sentinel

• Version analysis & tracking
• Dependency graph generation
• Security vulnerability scanning
• Package quality & maintenance metrics
• Download trends & statistics
• TypeScript support verification
• Bundle size & import‑cost analysis
• Real‑time package comparison
• Standardized MCP response format with error handling
• Efficient caching and rate‑limit management
• Strong schema validation using Zod

Use cases of Npm Sentinel

• CI/CD pipelines: Automatically reject packages with known vulnerabilities or low quality scores.
• IDE assistance: Provide instant insights while coding, e.g., in VS Code or Claude Desktop.
• Package selection: Compare alternatives and view maintenance activity before adding a dependency.
• Security audits: Generate comprehensive security reports for a project's dependency tree.
• Performance budgeting: Assess bundle size impact of new libraries during design reviews.

FAQ from the Npm Sentinel

Q: Do I need to modify my existing npm workflow? A: No. The server works as an MCP side‑car; your normal npm install commands remain unchanged.

Q: Can I run the server locally without Docker? A: Yes. Use npx @nekzus/mcp-server@latest (STDIO) or start the HTTP variant with npm run start:http.

Q: Is an API key required? A: The core functionality does not require an API key, but some optional AI back‑ends (Claude, Anthropic) may need credentials set in the environment.

Q: How does caching work? A: Frequently requested package metadata is cached in memory, reducing external registry calls and respecting rate limits.

Q: What languages are supported? A: The server is written in TypeScript and can be invoked from any MCP‑compatible client across languages.

NPM Sentinel MCP

A powerful Model Context Protocol (MCP) server that revolutionizes NPM package analysis through AI. Built to integrate with Claude and Anthropic AI, it provides real-time intelligence on package security, dependencies, and performance. This MCP server delivers instant insights and smart analysis to safeguard and optimize your npm ecosystem, making package management decisions faster and safer for modern development workflows.

Features

• Version analysis and tracking
• Dependency analysis and mapping
• Security vulnerability scanning
• Package quality metrics
• Download trends and statistics
• TypeScript support verification
• Package size analysis
• Maintenance metrics
• Real-time package comparisons
• Standardized error handling and MCP response formats
• Efficient caching for improved performance and API rate limit management
• Rigorous schema validation and type safety using Zod

Note: The server provides AI-assisted analysis through MCP integration.

Installation

Migration to HTTP Streamable

This MCP server now supports both STDIO and HTTP streamable transport. Your existing STDIO configuration will continue to work without changes.

New capabilities:

• HTTP streamable transport via Smithery.ai
• Enhanced scalability and performance
• Interactive testing playground

Development commands:

# Development server with playground
npm run dev

# Build for HTTP
npm run build:http

# Start HTTP server
npm run start:http

Install in VS Code

Add this to your VS Code MCP config file. See VS Code MCP docs for more info.

{
  "servers": {
    "npm-sentinel": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@nekzus/mcp-server@latest"]
    }
  }
}

Smithery.ai Deployment (HTTP Streamable)

This MCP server now supports HTTP streamable transport through Smithery.ai for enhanced scalability and performance. You can deploy it directly on Smithery.ai: Benefits of HTTP deployment:

• Scalable: Handles multiple concurrent connections
• Streamable: Real-time streaming responses
• Managed: Automatic deployment and monitoring
• Backward Compatible: Still supports STDIO for local development
• Interactive Testing: Built-in playground for testing tools

Configuration for Smithery.ai:

{
  "mcpServers": {
    "npm-sentinel": {
      "type": "http",
      "url": "https://smithery.ai/server/@Nekzus/npm-sentinel-mcp"
    }
  }
}

Docker

Build

# Build the Docker image
docker build -t nekzus/npm-sentinel-mcp .

Usage

You can run the MCP server using Docker with directory mounting to /projects:

{
  "mcpServers": {
    "npm-sentinel-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-w", "/projects",
        "--mount", "type=bind,src=${PWD},dst=/projects",
        "nekzus/npm-sentinel-mcp",
        "node",
        "dist/index.js"
      ]
    }
  }
}

For multiple directories:

{
  "mcpServers": {
    "npm-sentinel-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-w", "/projects",
        "--mount", "type=bind,src=/path/to/workspace,dst=/projects/workspace",
        "--mount", "type=bind,src=/path/to/other/dir,dst=/projects/other/dir,ro",
        "nekzus/npm-sentinel-mcp",
        "node",
        "dist/index.js"
      ]
    }
  }
}

Note: All mounted directories must be under /projects for proper access.

Usage with Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "npmsentinel": {
      "command": "npx",
      "args": ["-y", "@nekzus/mcp-server@latest"]
    }
  }
}

Configuration file locations:

• Windows: %APPDATA%\Claude\claude_desktop_config.json
• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Linux: (Claude for Desktop does not officially support Linux at this time)

NPX

{
  "mcpServers": {
    "npm-sentinel-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@nekzus/mcp-server@latest"
      ]
    }
  }
}

API

The server exposes its tools via the Model Context Protocol. All tools adhere to a standardized response format:

{
  "content": [
    {
      "type": "text",
      "text": "string",
      "isError": boolean // Optional
    }
    // ... more content items if necessary
  ]
}

Resources

• npm://registry: NPM Registry interface
• npm://security: Security analysis interface
• npm://metrics: Package metrics interface

Server Resources

The server also provides the following informational resources accessible via MCP GetResource requests:

• doc://server/readme:
  • Description: Retrieves the main README.md file content for this NPM Sentinel MCP server.
  • MIME Type: text/markdown
• doc://mcp/specification:
  • Description: Retrieves the llms-full.txt content, providing the comprehensive Model Context Protocol specification.
  • MIME Type: text/plain

Tools

npmVersions

• Get all versions of a package
• Input: packages (string[])
• Returns: Version history with release dates

npmLatest

• Get latest version information
• Input: packages (string[])
• Returns: Latest version details and changelog

npmDeps

• Analyze package dependencies
• Input: packages (string[])
• Returns: Complete dependency tree analysis

npmTypes

• Check TypeScript support
• Input: packages (string[])
• Returns: TypeScript compatibility status

npmSize

• Analyze package size
• Input: packages (string[])
• Returns: Bundle size and import cost analysis

npmVulnerabilities

• Scan for security vulnerabilities
• Input: packages (string[])
• Returns: Security advisories and severity ratings

npmTrends

• Get download trends
• Input:
  • packages (string[])
  • period ("last-week" | "last-month" | "last-year")
• Returns: Download statistics over time

npmCompare

• Compare multiple packages
• Input: packages (string[])
• Returns: Detailed comparison metrics

npmMaintainers

• Get package maintainers
• Input: packages (string[])
• Returns: Maintainer information and activity

npmScore

• Get package quality score
• Input: packages (string[])
• Returns: Comprehensive quality metrics

npmPackageReadme

• Get package README
• Input: packages (string[])
• Returns: Formatted README content

npmSearch

• Search for packages
• Input:
  • query (string)
  • limit (number, optional)
• Returns: Matching packages with metadata

npmLicenseCompatibility

• Check license compatibility
• Input: packages (string[])
• Returns: License analysis and compatibility info

npmRepoStats

• Get repository statistics
• Input: packages (string[])
• Returns: GitHub/repository metrics

npmDeprecated

• Check for deprecation
• Input: packages (string[])
• Returns: Deprecation status and alternatives

npmChangelogAnalysis

• Analyze package changelogs
• Input: packages (string[])
• Returns: Changelog summaries and impact analysis

npmAlternatives

• Find package alternatives
• Input: packages (string[])
• Returns: Similar packages with comparisons

npmQuality

• Assess package quality
• Input: packages (string[])
• Returns: Quality metrics and scores

npmMaintenance

• Check maintenance status
• Input: packages (string[])
• Returns: Maintenance activity metrics

Build

# Install dependencies
npm install

# Build for STDIO (traditional)
npm run build:stdio

# Build for HTTP (Smithery)
npm run build:http

# Development server
npm run dev

License

This MCP server is licensed under the MIT License. This means you are free to use, modify, and distribute the software, subject to the terms and conditions of the MIT License. For more details, please see the LICENSE file in the project repository.

---

MIT © nekzus