How do I install NPMScan?

Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.

No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.

How is the trust score calculated?

This listing scores 52 (Fair). The formula is published on the methodology page.

NPMScan MCP Server — Install for Claude, Cursor & VS Code | MCPpedia

Name: NPMScan MCP Server
Author: salemalem

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

RegistryRemotesalemalem

52Fair

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "salemalem-npmscan-mcp-plugin": {
      "url": "https://npmscan.com/api/mcp"
    }
  }
}

This server does not declare environment variables.

Tools show up when the registry metadata or the repository README lists them. GitHub enrichment fills this in when a token is configured.

77Good

MCP server for Firecrawl — web search, scraping, and biomedical/arXiv paper search.

RegistryRemotefirecrawl7.6K stars