Nekzus Npm Sentinel MCP

What Nekzus-npm-sentinel-mcp MCP server does

Nekzus-npm-sentinel-mcp MCP server gives MCP clients access to analysis of NPM packages. Its coverage includes known security issues, direct and transitive dependencies, package versions, maintenance indicators, download trends, and bundle-size information. Results can combine data from the NPM registry, Google's deps.dev, OSV.dev, OpenSSF Scorecard, GitHub repository metrics, and npms.io.

The server is suited to development workflows that need package research before adding or upgrading a dependency. It can also help an agent inspect dependency relationships, compare package alternatives, and assess package health using current external data.

How it works

The server can run locally over STDIO with the published @nekzus/mcp-server package, or expose a Web Standard Streamable HTTP handler for environments such as Cloudflare Workers, Hono, Vercel, Express, Fastify, and Next.js API routes. The README also documents deployment through Smithery and Docker.

Requests use package-name arrays and may include an optional ignoreCache flag. Batch analysis is limited to 25 packages per request. The server sanitizes inputs, limits search queries to 100 characters, and applies checks intended to reduce path traversal, SSRF, command injection, prototype pollution, and registry-enumeration risks.

Version resolution accepts forms such as major versions, prefixed versions, and ranges. Examples include express@2, express@v4, zod@3.x, react@^18, and lodash@~4.17; the server resolves these to the highest matching release rather than requiring an exact version key.

Tools and capabilities

Nekzus-npm-sentinel-mcp MCP server provides capabilities for:

• Checking package and dependency security with deps.dev and OSV.dev.
• Building dependency and transitive-dependency maps.
• Resolving package versions and retrieving version information.
• Finding functional package alternatives with ecosystem-aware filtering.
• Reviewing quality and maintenance signals from Scorecard, GitHub, and npms.io.
• Inspecting download trends and bundle-size data.
• Reading package documentation and changelog material with untrusted-content markers.

External README, changelog, and release-note text is marked as untrusted. Responses can include XML-style delimiters, _meta.untrustedExternalContent, and source metadata so clients can distinguish package content from tool instructions.

Setup and configuration

For local clients, the documented configuration runs npx -y @nekzus/mcp-server@latest as a STDIO process. The README provides configuration examples for Claude Desktop, VS Code, and Cursor. A Docker example mounts a project directory and starts the compiled server. HTTP deployments can import createMcpHttpHandler from @nekzus/mcp-server/http.

Development from source uses pnpm: install dependencies with pnpm install, compile with pnpm run build, and start with pnpm run start. The provided development command starts a Smithery CLI playground. No required environment variables are documented in the supplied material.

The cache is automatically invalidated when pnpm-lock.yaml, package-lock.json, or yarn.lock changes in the workspace. Set ignoreCache to true on a request when a fresh lookup is needed.

Limitations and notes

Batch requests cannot contain more than 25 packages, and search queries are capped at 100 characters. Analysis depends on external package and repository data, including NPM, deps.dev, OSV.dev, GitHub, OpenSSF Scorecard, and npms.io sources. Documentation and changelog responses may contain third-party text; clients should treat content marked as untrusted as data rather than instructions. The supplied material does not specify a software license or environment variables.