# mikusnuz/npm-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/mikusnuz/npm-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 318  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mikusnuz-npm-mcp

## Description
MCP server for npm package management — 36 tools for publish, version, search, audit, install, and more from your AI assistant.

## Tools
Capabilities this server exposes over MCP:

- **publish** — Publish a package to the npm registry
- **stage** — Stage a package, inspect pending versions, download a tarball, or approve/reject a stage. Approval publishes the version; rejection removes the staged version. Requires an npm CLI supporting npm stage.
- **version** — Bump the package version
- **view** — View package information from the registry
- **search** — Search npm registry for packages
- **unpublish** — Remove a package version from the registry
- **deprecate** — Deprecate a version of a package
- **owner** — Manage package owners
- **dist-tag** — Manage distribution tags
- **pack** — Create a tarball from a package (preview what would be published)
- **whoami** — Check which npm user is currently authenticated. If not logged in, set NPM_TOKEN env var in MCP config.
- **init** — Initialize a new package.json
- **audit** — Run a security audit on the package
- **outdated** — Check for outdated packages in a project
- **ls** — List installed packages in a project
- **pending-scripts** — List dependencies whose install scripts need review without changing package.json. Requires npm 12 or later.
- **approve-scripts** — Approve reviewed dependency install scripts, pinned by npm to installed versions. Only changes policy; does not run scripts. Requires npm 12+. Never approve packages without reviewing them.
- **deny-scripts** — Deny install scripts for named dependencies across all versions. Only changes package.json policy. Requires npm 12+.
- **install** — Install packages in a project
- **uninstall** — Remove packages from a project
- **update** — Update packages in a project to their latest semver-compatible version
- **access** — Set or view access level on published packages
- **token** — Manage npm access tokens (list or revoke)
- **ping** — Check connectivity to the npm registry
- **bugs** — Get the bug tracker URL for a package
- **repo** — Get the repository URL for a package
- **docs** — Get the documentation URL for a package
- **diff** — Show diff between package versions or between local and registry
- **pkg** — Manage package.json fields programmatically
- **fund** — Show funding information for installed packages
- **dedupe** — Reduce duplication in the dependency tree
- **explain** — Explain why a package is installed (show dependency chain)
- **sbom** — Generate a Software Bill of Materials (SBOM) for a project
- **profile** — View or modify npm user profile settings
- **ci** — Clean install dependencies from lockfile (for CI environments)
- **run-script** — Run a script defined in package.json
- **doctor** — Run diagnostics to check npm environment health
- **cache** — Manage the npm cache
- **config** — View npm configuration (read-only for safety)
- **prune** — Remove extraneous packages not listed in package.json
- **link** — Symlink a local package for development
- **query** — Query installed packages using CSS-like selectors

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "npm-mcp": {
    "command": "npx",
    "args": ["-y","@mikusnuz/npm-mcp"],
    "env": {
      "NPM_TOKEN": "",
      "NPM_PATH": ""
    }
  }
}
```

**Requires environment variables:** `NPM_TOKEN`, `NPM_PATH` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What mikusnuz/npm-mcp does

mikusnuz/npm-mcp brings npm workflows into MCP-compatible AI clients. It can work with local project directories for package installation, removal, updates, version changes, packing, auditing, and other dependency operations. It also queries the npm registry for package metadata, search results, documentation links, repository links, bug trackers, version differences, and download-related package information.

Publishing workflows include direct publication, version bumps, package removal, deprecation, and dry-run packing. The `stage` tool supports staged package publication, listing staged versions, inspecting or downloading them, and approving or rejecting a staged release. Approval and rejection require maintainer two-factor authentication.

## How it works

The server runs as a Node.js process and exposes npm operations as MCP tools. Local-project tools accept a project path; registry and package tools accept package names or version specifications. For example, an agent can bump a project from its current version, publish it, inspect the contents that would be packed, or compare two package versions.

Authentication can come from an `NPM_TOKEN` supplied in the MCP client configuration or from credentials already stored by `npm login` in the user’s npm configuration. Two-factor authentication codes can be passed for operations that require them, including staged release approval or rejection and certain maintainer or token changes.

Dependency script controls are designed for npm 12 and later. An agent can list unreviewed install scripts, then approve specific reviewed dependencies with version pinning or deny named dependencies. These policy operations do not execute the scripts; the intended installation or build must be run separately.

## Setup and configuration

Install the project from its repository, install dependencies, and build it with npm:

```bash
git clone https://github.com/mikusnuz/npm-mcp.git
cd npm-mcp
npm install
npm run build
```

Configure an MCP client to launch `dist/index.js` with Node.js. A typical configuration supplies the npm token through `NPM_TOKEN`:

```json
{
  "mcpServers": {
    "npm-mcp": {
      "command": "node",
      "args": ["/path/to/npm-mcp/dist/index.js"],
      "env": {
        "NPM_TOKEN": "npm_xxxxxxxxxxxx"
      }
    }
  }
}
```

Use `NPM_PATH` when the npm executable is not the one available on the system path, or when a separate npm installation is needed. Staged publishing requires npm 11.15.0 or later and Node.js 22.14.0 or later. The server requires Node.js 20 or newer overall.

## Tools and capabilities

Publishing and release management include `publish`, `stage`, `version`, `unpublish`, `deprecate`, and `pack`. Registry inspection includes `view`, `search`, `bugs`, `repo`, `docs`, and `diff`.

Project dependency operations include `install`, `uninstall`, `update`, `outdated`, `ls`, `explain`, `dedupe`, `prune`, `fund`, and `query`. Security and diagnostics include `audit`, `sbom`, `doctor`, and `ping`. The server also exposes `pending-scripts`, `approve-scripts`, and `deny-scripts` for npm 12 script policy workflows, plus `whoami` for checking the authenticated npm account.

The package supports common release tasks such as publishing a scoped package, checking outdated dependencies, generating CycloneDX or SPDX SBOM output, and querying dependencies with CSS-like selectors.

## Limitations and notes

Staged publication is separate from direct publication: the package is not published until a staged version is approved. Approval and rejection require maintainer 2FA, and staged workflows may require a stage-capable token. Direct publishing with a stage-only token fails with `E_STAGE_REQUIRED`.

npm version differences affect available operations. In particular, the install-script approval tools require npm 12 or newer, and older npm versions do not support those options. Approval is explicit rather than bulk, and a lockfile can result in a name-only approval when a trusted resolved version cannot be pinned.

_Full upstream README: https://allmcps.com/mcp/mikusnuz-npm-mcp/readme_