NPMScan

Get npm package details

get_package

Read-only

Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, recent version history, weekly downloads, GitHub stars, TypeScript support, days since last publish, a topPackagesRank (position among npm's ~100k most-downloaded packages, from npmscan's own periodically-refreshed snapshot — not live), and a downloadTrend (growing/stable/declining vs. ~3 months ago). Also checks the LATEST version against OSV.dev for known vulnerabilities — isLatestVersionVulnerable/highestSeverity give a direct safe/not-safe answer, and each finding includes severity, a summary, and the fixedVersion to upgrade to (use get_package_version or query_vulnerabilities to check a specific older version instead). Also returns popularityTier/maintenanceTier (deterministic rule-based labels, not model-generated) and a plain-language maintenanceSummary, plus a possibleTyposquatOf flag if the name is one typo away from a top-5,000 package while itself being obscure — read deprecated and maintenanceSummary before recommending a package, since a long gap since the last release can mean either a stable/finished package or a slowing one. Includes a link to the full npmscan.com analysis page.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`name`	Yes	Exact npm package name, e.g. "lodash" or "@scope/name"

Output Schema

TableJSON Schema

Name	Required	Description	Default
`name`	Yes
`license`	Yes
`distTags`	Yes
`homepage`	Yes
`keywords`	Yes
`createdAt`	Yes
`modifiedAt`	Yes
`npmscanUrl`	Yes
`repository`	Yes
`description`	Yes
`githubStars`	Yes
`maintainers`	Yes
`downloadTrend`	Yes
`latestVersion`	Yes
`popularityTier`	Yes
`recentVersions`	Yes
`hasBuiltInTypes`	Yes
`highestSeverity`	Yes
`maintenanceTier`	Yes
`topPackagesRank`	Yes
`vulnerabilities`	Yes
`weeklyDownloads`	Yes
`latestVersionInfo`	Yes
`maintenanceSummary`	Yes
`possibleTyposquatOf`	Yes
`daysSinceLastPublish`	Yes
`isLatestVersionVulnerable`	Yes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed4 schema fields changedSep 1, 2026

addedOutput schema / properties / highestSeverity

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / isLatestVersionVulnerable
```
Added value: +{
+  "type": "boolean"
+}
```

addedOutput schema / properties / vulnerabilities

Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "aliases": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "fixedVersion": {
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "npmscanUrl": {
+        "type": "string"
+      },
+      "publishedAt": {
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "severity": {
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "summary": {
+        "type": [
+          "string",
+          "null"
+        ]
+      }
+    },
+    "required": [
+      "id",
+      "summary",
+      "severity",
+      "aliases",
+      "publishedAt",
+      "fixedVersion",
+      "npmscanUrl"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedOutput schema / required

Previous value: -[
-  "name",
-  "description",
-  "license",
-  "homepage",
-  "repository",
-  "keywords",
-  "maintainers",
-  "distTags",
-  "latestVersion",
-  "latestVersionInfo",
-  "recentVersions",
-  "createdAt",
-  "modifiedAt",
-  "npmscanUrl",
-  "weeklyDownloads",
-  "githubStars",
-  "hasBuiltInTypes",
-  "daysSinceLastPublish",
-  "popularityTier",
-  "maintenanceTier",
-  "maintenanceSummary",
-  "topPackagesRank",
-  "downloadTrend",
-  "possibleTyposquatOf"
-]New value: +[
+  "name",
+  "description",
+  "license",
+  "homepage",
+  "repository",
+  "keywords",
+  "maintainers",
+  "distTags",
+  "latestVersion",
+  "latestVersionInfo",
+  "recentVersions",
+  "createdAt",
+  "modifiedAt",
+  "npmscanUrl",
+  "weeklyDownloads",
+  "githubStars",
+  "hasBuiltInTypes",
+  "daysSinceLastPublish",
+  "popularityTier",
+  "maintenanceTier",
+  "maintenanceSummary",
+  "topPackagesRank",
+  "downloadTrend",
+  "possibleTyposquatOf",
+  "isLatestVersionVulnerable",
+  "highestSeverity",
+  "vulnerabilities"
+]

Changed1 schema field changedSep 1, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "createdAt": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "daysSinceLastPublish": {
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "description": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "distTags": {
+      "additionalProperties": {
+        "type": "string"
+      },
+      "type": "object"
+    },
+    "downloadTrend": {
+      "additionalProperties": false,
+      "properties": {
+        "changePercent": {
+          "type": [
+            "number",
+            "null"
+          ]
+        },
+        "direction": {
+          "enum": [
+            "growing",
+            "stable",
+            "declining",
+            "unknown"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "direction",
+        "changePercent"
+      ],
+      "type": "object"
+    },
+    "githubStars": {
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "hasBuiltInTypes": {
+      "type": "boolean"
+    },
+    "homepage": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "keywords": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "latestVersion": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "latestVersionInfo": {
+      "anyOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "dependencies": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "deprecated": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "scripts": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "tarball": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "version": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "version",
+            "dependencies",
+            "scripts",
+            "deprecated",
+            "tarball"
+          ],
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "license": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "maintainers": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "email": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "maintenanceSummary": {
+      "type": "string"
+    },
+    "maintenanceTier": {
+      "enum": [
+        "active",
+        "aging",
+        "stale",
+        "unknown"
+      ],
+      "type": "string"
+    },
+    "modifiedAt": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "name": {
+      "type": "string"
+    },
+    "npmscanUrl": {
+      "type": "string"
+    },
+    "popularityTier": {
+      "enum": [
+        "very-high",
+        "high",
+        "moderate",
+        "low",
+        "very-low",
+        "unknown"
+      ],
+      "type": "string"
+    },
+    "possibleTyposquatOf": {
+      "anyOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "rank": {
+              "type": "number"
+            }
+          },
+          "required": [
+            "name",
+            "rank"
+          ],
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "recentVersions": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "publishedAt": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "version": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "version",
+          "publishedAt"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "topPackagesRank": {
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "weeklyDownloads": {
+      "type": [
+        "number",
+        "null"
+      ]
+    }
+  },
+  "required": [
+    "name",
+    "description",
+    "license",
+    "homepage",
+    "repository",
+    "keywords",
+    "maintainers",
+    "distTags",
+    "latestVersion",
+    "latestVersionInfo",
+    "recentVersions",
+    "createdAt",
+    "modifiedAt",
+    "npmscanUrl",
+    "weeklyDownloads",
+    "githubStars",
+    "hasBuiltInTypes",
+    "daysSinceLastPublish",
+    "popularityTier",
+    "maintenanceTier",
+    "maintenanceSummary",
+    "topPackagesRank",
+    "downloadTrend",
+    "possibleTyposquatOf"
+  ],
+  "type": "object"
+}

First observedAug 1, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true, openWorldHint=true, and destructiveHint=false, so the agent knows this is a safe, read-only operation. The description adds significant behavioral context beyond these: it discloses that topPackagesRank comes from a "periodically-refreshed snapshot — not live", explicitly states that popularityTier/maintenanceTier are "deterministic rule-based labels, not model-generated", and warns that a long gap since last release "can mean either a stable/finished package or a slowing one" — a critical interpretive caveat. It also flags the possibleTyposquatOf signal and the need to check deprecated and maintenanceSummary. This is rich behavioral context that complements the annotations rather than repeating them. A small deduction: the description does not explicitly describe the output schema's structure (e.g., whether findings are in an array, or the exact field names for each vulnerability), but the output schema exists and is not nested, and the description gives enough field names to be useful. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is comprehensive but somewhat long and dense. It front-loads the core purpose and key data fields, which is good, but then includes a long parenthetical about topPackagesRank and a second parenthetical about rule-based labels, making the text feel packed. The mention of "Also checks the LATEST version against OSV.dev" and the advisory to "read deprecated and maintenanceSummary" are valuable, but the description could be more concise by trimming redundant phrasing like "(preinstall/postinstall are a key risk signal)" which, while useful, adds length. The structure is a single paragraph with several clauses chained, which is acceptable but not optimally scannable. It's informative but could be tightened without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (it returns a rich set of fields, including vulnerability data, popularity metrics, and a possible typosquat signal) and the presence of an output schema, the description covers almost everything an agent needs to call it correctly. It explains the return fields, the caveats about the data's freshness and label types, how to interpret maintenance gaps, and directs to alternative tools for specific older version checks. The only missing piece is an explicit note about required authentication or rate limits, but the annotations (readOnlyHint) and openWorldHint suggest no destructive effects, and no auth is mentioned for the sibling tools either—this seems consistent. The description is substantial and covers the key decision points, warranting a 4 rather than a 5 due to the lack of explicit instructions on pagination or why one might prefer this tool over search_packages when searching, but for its purpose, it's nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage for its single parameter, `name`, with a description including examples and validation constraints. The tool description does not add parameter-specific semantics beyond what the schema already conveys; the parameter is straightforward (a package name string). The description does provide additional context about how the `name` is interpreted (exact npm package name), but this is already in the schema. Since schema coverage is high, the baseline is 3, and the description doesn't need to compensate. There's no additional field-level detail in the description that would elevate the score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific statement of the tool's purpose: "Fetch npm registry metadata for a package..." immediately enumerating the concrete data fields returned (latest version, install scripts, maintainers, license, etc.). This goes well beyond a simple verb+resource, distinguishing it from siblings like get_package_version and query_vulnerabilities. The explicit mention of "preinstall/postinstall are a key risk signal" and "direct safe/not-safe answer" establishes a clear functional identity, and the later inclusion of "topPackagesRank" and "downloadTrend" further separates it from other package-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides partial usage guidance. It implicitly establishes when to use this tool (for a broad package health assessment) and explicitly mentions alternatives: "use get_package_version or query_vulnerabilities to check a specific older version instead" when needing to check a specific older version's vulnerabilities. However, it does not explicitly state when NOT to use this tool (e.g., when only a CVE lookup is needed, or when searching for packages — sibling search_packages). The guidance is implied through the mention of alternatives but lacks a clear 'when-not' clause. The conditional instruction to "read deprecated and maintenanceSummary before recommending a package" is useful and effectively guides usage, earning a 3 rather than a 2.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All NPMScan tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.4/5.0

Disambiguation4/5

Most tools target a distinct part of the supply-chain lifecycle, and the detailed descriptions include explicit cross-references that reduce misselection. The main ambiguity is among the vulnerability-lookup tools—especially get_latest_advisories and get_cve, which both accept CVE IDs, and query_vulnerabilities versus batch_query_vulnerabilities, which differ mainly in input shape.

Naming Consistency5/5

Every tool name uses lowercase snake_case with a leading imperative verb or verb phrase: analyze_, audit_, batch_query_, check_, compare_, diff_, get_, prioritize_, query_, search_, and suggest_. The check_* tools form a consistent sub-family, and there are no camelCase or noun-only strays.

Tool Count4/5

18 tools is on the high side, so the server feels slightly heavy rather than lean. However, the domain is broad enough that each tool occupies a meaningful workflow step—metadata lookup, vulnerability querying, transitive analysis, license/maintainer/provenance checks, repo auditing, diffing, and remediation—so the count is still reasonable for a comprehensive npm security server.

Completeness5/5

The surface covers the full npm supply-chain audit workflow: discovery, exact-version and lockfile vulnerability checks, transitive dependency resolution, install-script deep scans, license compliance, maintainer and provenance history, repo-level audits, dependency diffs, remediation prioritization, and alternative suggestions. There are no obvious dead ends, and the tools consistently point to natural follow-up actions.

Resources

Need Help?