About npm Supply Chain Audit
An MCP server for developers auditing npm dependencies for supply-chain risks. It checks typosquats, risky install hooks and unpinned versions, with live-registry checks for nonexistent or newly published packages.
Key features
- 01Typosquat detection against popular packages
- 02Install-script risk checks
- 03Wildcard and latest version flags
- 04Live npm registry package checks
- 05Deprecated and low-traffic release flags
Use cases
- 01Review package.json before installing dependencies
- 02Check a suspicious npm package name
- 03Find packages with risky lifecycle scripts
MCP support
Exposes package audit and package-name checking tools to MCP clients, including live npm registry inspection tools.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://npm-supply-chain-audit-mcp.mcpize.run/mcpclaude mcp add --transport http tylerscomic-lab-npm-supply-chain-audit https://npm-supply-chain-audit-mcp.mcpize.run/mcp{"mcpServers":{"tylerscomic-lab-npm-supply-chain-audit":{"type":"http","url":"https://npm-supply-chain-audit-mcp.mcpize.run/mcp"}}}Open in Cursor{"servers":{"tylerscomic-lab-npm-supply-chain-audit":{"type":"http","url":"https://npm-supply-chain-audit-mcp.mcpize.run/mcp"}}}Open in VS Code{"mcpServers":{"tylerscomic-lab-npm-supply-chain-audit":{"type":"http","url":"https://npm-supply-chain-audit-mcp.mcpize.run/mcp"}}}{"mcpServers":{"tylerscomic-lab-npm-supply-chain-audit":{"serverUrl":"https://npm-supply-chain-audit-mcp.mcpize.run/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
Details
From the project READMEnpm-supply-chain-audit-mcp
An MCP server that audits package.json for the real mechanisms behind actual npm supply-chain incidents —
typosquatting and malicious install scripts — not a generic vulnerability-database lookup.
What it catches
Typosquatting. Dependency names within 1-2 character edit distance of one of the npm registry's
most-depended-on packages (lodash, express, react, axios, and ~90 others) — the actual real targets of
typosquat campaigns, since attackers go after the packages with the largest install base. lodahs, expres,
reqeust all flag; an unrelated, genuinely distinct package name doesn't.
Malicious install scripts. preinstall/install/postinstall hooks run automatically on npm install,
before any of the package's own code is ever reviewed — the actual delivery mechanism behind real incidents
(event-stream 2018, ua-parser-js 2021, and others since). Flags scripts that pipe a remote download directly
into a shell, and scripts that decode an obfuscated base64 payload before running it.
Unpinned versions. Dependencies on * or latest pull in whatever gets published next, silently, with no
diff in your repo to explain why your dependency tree changed.
Tools
audit_package_json
Full audit of a package.json file.
check_package_name
Focused typosquat check on a single package name.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.js
Part of a small suite
secrets-leak-audit-mcp, mcp-trust-audit-mcp, github-actions-audit-mcp, dockerfile-audit-mcp.
License
MIT
Update 1.1.0 (2026-10-01)
- New tools
inspect_package_liveandaudit_dependencies_live: look packages up on the live npm registry. Flags names that do not exist (hallucinated or mistyped), brand-new low-traffic packages, install scripts, deprecated releases and typosquats.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.