Augments MCP Server vs NPMScan
A side-by-side look at the Augments MCP Server and NPMScan MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
N
NPMScanDeveloper ToolsDetect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups48FairAuth: no auth requiredVerdict: choose Augments MCP Server for developer tools work as a local process; choose NPMScan for developer tools. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Augments MCP Server when
- You need dedicated capabilities in the Developer Tools domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
get_api_context, search_apis, get_version_info.
NChoose NPMScan when
- You need dedicated capabilities in the Developer Tools domain.
- Its auth model fits you: No auth required.
- You want tools like
search_packages, get_package, get_package_version.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | N NPMScan | |
|---|---|---|
| Category | Developer Tools | Developer Tools |
| Quality signal | 60/100 · Good | 48/100 · Fair |
| Install command | Confirmed | Not confirmed yet |
| Transport | Local subprocess (stdio) | — |
| Auth | No auth required | No auth required |
| Pricing | Free | Free |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 127 | 0 |
| Directory activity | 5 views 0 installs 0 upvotes | 0 views 0 installs 0 upvotes |
| Tools | 8 | 23 |
| Full listing | View Augments MCP Server | View NPMScan |
Tools & capabilities
Augments MCP Server tools 8
get_api_contextRECOMMENDED: Get precise API signatures, parameters, return types, prose documentation, and code examples for any npm package. Handles natural language like "react useEffect cleanup" or "how to use zustand". Always try this first.search_apisSearch for APIs across multiple frameworks when you don't know the exact name. Supports concept search like 'state management' which matches useState, createStore, atom, etc.get_version_infoGet version info, available versions, and breaking change detection for any npm package. Now includes actual breaking changes and new features from changelogs.get_migration_guideGet a detailed migration guide between package versions. Returns breaking changes, new features, deprecations, type diffs, and official migration docs.diagnose_errorDiagnose an error message or stack trace. Matches against known error patterns, searches GitHub issues, and finds relevant documentation.compare_packagesCompare npm packages side-by-side: downloads, bundle size, dependencies, GitHub stars, exported APIs. Great for choosing between alternatives.scan_project_depsScan project dependencies for outdated packages, major updates, deprecated packages, and security advisories. Reads package.json.diagnosticsGet server health information: version, uptime, memory usage, cache statistics, and Node.js version.
NPMScan tools 23
search_packagesSearch the npm registry by name or keywords. Each result includes weekly/monthly download counts, dependent-package counts, and rank among npmscan's own top-100k-by-downloads snapshot, so you can tell an established package from an abandoned or squatted one that merely matches the query text — flag…get_packageLatest version, install scripts (`preinstall`/`install`/`postinstall`/`prepare`), maintainers, license, recent version history, weekly downloads, GitHub stars, TypeScript support, days since last publish, ecosystem-wide download rank, a 3-month download trend, and an `isLatestVersionVulnerable`/`hi…get_package_versionMetadata for one exact version plus an OSV.dev check scoped to that version — `isVulnerable`/`highestSeverity` as a direct safe/not-safe answer, with each finding's severity, summary, fixed version and `isMalware`. For checking a version pinned in a lockfile. A version npm has removed but OSV still…get_maintainer_profilePackages an npm username currently maintains via npm's own `maintainer:<username>` search index, plus precomputed download/dependent totals across all of them. Lists the most-downloaded `limit` packages (default 50, max 250); totals still cover every package found. A plain info lookup, not a securi…query_vulnerabilitiesOSV.dev lookup for known vulnerabilities affecting a package, optionally scoped to a version, with `isVulnerable`/`highestSeverity` as a direct verdict and each finding's severity, summary, fixed version and `isMalware`. For npm it also cross-checks the name/version against the registry: a name or…batch_query_vulnerabilitiesOSV.dev lookup across a whole dependency inventory at once — pass a flat `packages` list, or paste raw `package.json`/lockfile/CycloneDX JSON/SPDX JSON content via `content` and it parses that for you. Chunks large inventories internally, with severity, summary, CVE aliases, fixed version and `isMa…get_latest_advisoriesRecently published npm advisories from one of three sources (one per call): `type: "reviewed"` (default) is GitHub's curated, mostly CVE-backed set, filterable by severity, vulnerability category, affected package name, or an exact GHSA/CVE ID; `type: "malware"` is GitHub's own malicious-package ad…get_cveNIST NVD lookup for one exact CVE ID (authoritative CVSS score/vector, CWEs, references), or a keyword/severity/CWE/date-range search. Enriched with CISA KEV status (actively exploited in the wild?) and FIRST.org EPSS (30-day exploitation probability). Falls back to the raw MITRE CVE record when NV…analyze_install_scriptFetches a package's published tarball and statically scans its `preinstall`/`install`/`postinstall`/`prepare` lifecycle scripts — and the files they reference, pulled from the tarball itself — against npmscan's red-flags rubric (`child_process` use, network calls, sensitive-path/env access, obfusca…analyze_transitive_dependenciesRecursively resolves 1-15 direct/root packages' dependency graphs to a configurable depth (default 2, max 3) and batch-checks every resolved package against OSV.dev — surfaces vulnerabilities buried several levels deep that a flat `batch_query_vulnerabilities` call would miss, with `vulnerablePaths…check_package_provenanceChecks a version's npm/Sigstore publish provenance against reality: flags a non-GitHub-hosted builder or an attested source repo that doesn't match `package.json`'s own `repository` field; flags a package missing provenance while its npm-scope/maintainer peers consistently have it (skipped for vers…check_maintainer_changesReconstructs a package's maintainer-add/remove history from the npm packument and flags account-takeover patterns — a new maintainer who published shortly after being added, a sudden full maintainer-list replacement, a long-standing maintainer quietly dropped, or a maintainer change not yet tied to…- +11 more on the listing page
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Augments MCP Server
{
"mcpServers": {
"augmnt-augments-mcp-server": {
"command": "npx",
"args": [
"-y",
"@augmnt-sh/augments-mcp-server"
]
}
}
}
NPMScan
No confirmed install command for NPMScan yet — follow the setup steps linked from its listing page rather than a guessed package name.
Frequently asked questions
Augments MCP Server is categorized under Developer Tools and uses a local stdio subprocess. NPMScan belongs to Developer Tools and uses an install path we have not confirmed yet. Pick Augments MCP Server for developer tools work and NPMScan for developer tools.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client. NPMScan has no confirmed install command yet — follow its own setup instructions.
Augments MCP Server is listed as free. Auth: no auth required. NPMScan is listed as free. Auth: no auth required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add augmnt-augments-mcp-server and npmscan-2 as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Augments MCP Server has a quality signal of 60/100 (Good) with 5 views, 0 installs and 127 GitHub stars. NPMScan has 48/100 (Fair) with 0 views, 0 installs and 0 GitHub stars.