protogrid
Sign inAdd to your agent

Search / io.github.tylerscomic-lab/npm-supply-chain-audit-mcp

npm Supply Chain Audit

R2· OAuth, once

Check npm packages for typosquats, hallucinated names, install scripts and risky new releases.

v1.1.0 · active · repository · descriptor JSON · versions

An agent can connect after a one-time OAuth consent by a human.Remote endpoint behind OAuth 2. Tokens stay with the agent; the registry only exposes the authorization metadata.
Quality100strong
Trust94of 100
Uptime, 30 days97%
Latency p50670 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "npm-supply-chain-audit-mcp": {
      "type": "http",
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    }
  }
}
claude mcp add --transport http npm-supply-chain-audit-mcp https://npm-supply-chain-audit-mcp.mcpize.run/mcp
[mcp_servers.npm-supply-chain-audit-mcp]
url = "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "npm-supply-chain-audit-mcp": {
      "type": "remote",
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp",
      "enabled": true
    }
  }
}
{
  "mcpServers": {
    "npm-supply-chain-audit-mcp": {
      "type": "http",
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=npm-supply-chain-audit-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbnBtLXN1cHBseS1jaGFpbi1hdWRpdC1tY3AubWNwaXplLnJ1bi9tY3AifQ%3D%3D"
}
{
  "servers": {
    "npm-supply-chain-audit-mcp": {
      "type": "http",
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    }
  }
}
{
  "mcpServers": {
    "npm-supply-chain-audit-mcp": {
      "httpUrl": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    }
  }
}
extensions:
  "npm-supply-chain-audit-mcp":
    enabled: true
    name: "npm-supply-chain-audit-mcp"
    type: streamable_http
    uri: "https://npm-supply-chain-audit-mcp.mcpize.run/mcp"
    timeout: 300

Quality 100 / 100strong

protocoln/a · weight 25
  • n/a
    protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)
authorization100 · weight 15
  • pass
    auth.prmProtected Resource Metadata (RFC 9728) published
  • pass
    auth.as_metadataauthorization server metadata reachable
  • pass
    auth.cimdClient ID Metadata Documents supported
  • n/a
    auth.secret_in_urlno templated URL
tool hygienen/a · weight 30
  • n/a
    tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)
stabilityn/a · weight 15
  • n/a
    stability.changes, stability.rug_pulltool list unknown
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

Tool list unknown · checked 2026-10-19 10:52 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 94 / 100

provenance80
liveness99
freshness100
hygiene100

+repository +namespace-matches-repo +reachable +uptime-97% +updated-17d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://npm-supply-chain-audit-mcp.mcpize.run/mcp streamable-httpoauth2 AS: https://npm-supply-chain-audit-mcp.mcpize.runyes97%670 ms–2026-10-19

Tools (0)

No tools observed. Tools appear once a credential-free probe can list them.

Schemas: list_tools.

Similar MCP servers

  • npm Registry MCP ServerL0
    io.github.YawLabs/npmjs-mcp

    npm registry MCP server — package intelligence, security audits, dependency analysis

  • npmL0
    io.github.mikusnuz/npm

    MCP server for npm package management — publish, version, search, audit, and more

  • npm-search-mcpL0
    io.github.mrfentmen/npm-search-mcp

    Search npm packages and inspect package metadata from the public registry. No key required.

  • npm-searchL0
    io.github.ofershap/npm-search

    npm search MCP — find packages, view details, compare, check downloads.

  • NpmR0
    io.github.pipeworx-io/npm

    npm MCP — wraps the npm Registry API (free, no auth)

  • supply-chain-guardL0
    io.github.homeofe/supply-chain-guard

    Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.

More from io.github.tylerscomic-lab

  • Agent Skill & Config Security AuditR2quality 100
    io.github.tylerscomic-lab/agent-skill-audit-mcp

    Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.

  • Backtest Cost SensitivityR2quality 100
    io.github.tylerscomic-lab/backtest-cost-sensitivity-mcp

    Commission/slippage sensitivity sweep, breakeven cost finder, and lookahead-bias checklist.

  • FINRA Broker & Advisor CheckR2quality 100
    io.github.tylerscomic-lab/broker-advisor-check-mcp

    Vet US financial advisors and firms from live FINRA BrokerCheck records with ranked red flags.

  • Claude Cost AuditR2quality 100
    io.github.tylerscomic-lab/claude-cost-audit-mcp

    Exact Claude API cost calc with real cache economics, plus a tiktoken-misuse scanner.

  • Cron Schedule AuditR2quality 100
    io.github.tylerscomic-lab/cron-schedule-audit-mcp

    Validates cron expressions and finds DST bugs that make jobs silently skip or double-fire.

  • Dockerfile Security AuditR2quality 100
    io.github.tylerscomic-lab/dockerfile-audit-mcp

    Audit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.

And 20 more from this publisher.

Official server.json
{
  "name": "io.github.tylerscomic-lab/npm-supply-chain-audit-mcp",
  "title": "npm Supply Chain Audit",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://npm-supply-chain-audit-mcp.mcpize.run/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.1.0",
  "repository": {
    "url": "https://github.com/tylerscomic-lab/npm-supply-chain-audit-mcp",
    "source": "github"
  },
  "description": "Check npm packages for typosquats, hallucinated names, install scripts and risky new releases."
}