NPMScan

npm package & vuln lookups

Category: Pending
Primary Subcategory: Pending

Integration details

Description

Look up npm package metadata and known vulnerabilities directly from a conversation. NPMScan's MCP server gives AI agents six read-only tools backed by the npm registry, OSV.dev, and GitHub Security Advisories: search packages, inspect install scripts and maintainers before installing, check an exact version pinned in a lockfile, query vulnerabilities for one package or up to 100 at once (a full package.json/lockfile scan), and browse the latest reviewed advisories for the npm ecosystem. No API key or authentication is required, and every result links back to the full write-up on npmscan.com.

Integration type: Plugin
Verification status: Not applicable
Platform: ChatGPT
Category: Pending
Primary Subcategory: Pending
Secondary Subcategories: None listed
Brand: Unknown
Access: No account required
First tracked: 2026-09-01
Tool count: 6
Geography: US

ChatGPT Plugin Discovery Score

ChatGPT Plugin discovery is coming soon

ChatGPT can surface a Plugin when it matches a user's request.Your Plugin Discovery Score measures how often yours appears.

No spam. Unsubscribe any time.

ChatGPT recommends Airtable when a user asks it to update a CRM. — ChatGPT surfaces Airtable because it matches the user's request.

Primary Subcategory

Competitive lineup

No Primary Subcategory assigned yetOnce NPMScan has a Primary Subcategory, the Plugins and Connectors it competes with will appear here with their scores.

Tools

6 tools agents can invoke

Query OSV.dev for known vulnerabilities across up to 100 npm packages at once — ideal for scanning a whole package.json/lockfile in one call.
batch_query_vulnerabilities
Fetch registry metadata for one exact version of a package (dependencies, install scripts, tarball). Use this to check a version pinned in a lockfile rather than the latest release.
get_package_version
Browse the most recently published, reviewed GitHub Security Advisories for the npm ecosystem, optionally filtered by severity.
get_latest_advisories
Fetch npm registry metadata for a package: latest version, install scripts (preinstall/postinstall are a key risk signal), maintainers, license, and recent version history. Includes a link to the full npmscan.com analysis page.
get_package
Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one version. Use before recommending or installing a package.
query_vulnerabilities
Search the npm registry by name or keywords. Returns matching packages with a link to their full npmscan.com risk/analysis page.
search_packages

NPMScan FAQ

How do I improve a ChatGPT Plugin's discoverability?

The levers are the listing surface agents actually read: names, descriptions, keywords, tool metadata, and registry health. Which lever matters depends on where discovery breaks, which is what continuous measurement shows.

Where is this profile measured?

This profile uses the geography attached to the latest public registry snapshot: US. Locale tags are intentionally omitted.