npm Registry MCP Server

Run npm registry operations from Claude Code, Cursor, and any MCP client. 64 tools covering the full registry surface: package intelligence, security audits, dependency analysis, org/team management, and the write ops that normally fight you locally (npm deprecate, npm dist-tag, npm owner, npm unpublish). Its 40 documented tools cover npm, downloads, packages, org.

People who work with npm, downloads and packages and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-09-14 · ★ 2 · #54 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

MIT · TypeScript servers · how we verify → /methodology

01 · Install npm Registry MCP Server

before you install - you'll need

NPM_TOKEN

Environment variables documented in the project's README - it lists which are required and which have defaults.

Claude Code

claude mcp add yawlabs-npmjs-mcp -- npx -y @yawlabs/npmjs-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "yawlabs-npmjs-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@yawlabs/npmjs-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

npm package @yawlabs/npmjs-mcp - published under the repo owner's npm scope (@yawlabs)

registry namespace io.github.YawLabs is GitHub-verified and matches the repo owner

03 · What npm Registry MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can search the npm registry with qualifiers (keywords, author, scope), compare downloads for up to 128 packages, check packages for known vulnerabilities, and compare 2–5 packages side-by-side.

Capability map

Tools grouped from the project's README - what npm Registry MCP Server lets an agent do.

Npm

37 tools - e.g. Search the npm registry with qualifiers (keywords, author, scope).; Metadata: description, dist-tags, maintainers, license, repository.; Detailed metadata for a specific version.

npm_search · npm_package · npm_version · npm_versions · npm_readme · npm_dist_tags…

auth & access

3 tools - e.g. List access tokens.; One-call capability check. Call this first when debugging write failures.; Auth health check with headless publish feasibility.

npm_tokens · npm_verify_token · npm_check_auth

Latest releases

v0.16.3 · 2026-09-14

Fixed · npm_check_auth and npm_publish_preflight no longer tell you to set up an "automation token" or to run npm login. Classic tokens, Automation tokens included, were revoked on 2025-12-09, and npm login replaces…

v0.16.2 · 2026-09-14

Fixed · A 422 now describes the registry call that failed, instead of three causes that mostly could not apply. Every 422 used to list the same three causes whatever the tool -- a semver range matching no published…

v0.16.1 · 2026-09-14

Changed · npm and MCP Registry listing metadata: bugs URL, core keywords, and server.json title/repository/websiteUrl. · release.sh writes a ## [x.y.z] changelog entry for every release -- promoting [Unreleased] when…

04 · Who maintains npm Registry MCP Server

npm Registry MCP Server is maintained by yawlabs. We track 12 MCP servers from yawlabs - 12 actively maintained, 77 combined GitHub stars, oldest repo from Apr 2026. Full record: all servers from yawlabs.

05 · Facts

repository: github.com/yawlabs/npmjs-mcp
website: https://yaw.sh/mcp-servers/npmjs-mcp/
category: security - ranked #54 of 204 actively-maintained security servers as of 2026-09-18.
release cadence: 10+ releases in the last 90 days (latest 2026-09-14)
registry: io.github.YawLabs/npmjs-mcp (active, first published 2026-05-15 · 23 versions)
packages: npm:@yawlabs/npmjs-mcp

06 · npm Registry MCP Server FAQ

Is npm Registry MCP Server still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-14 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

What can npm Registry MCP Server do?

How do I install npm Registry MCP Server?

Run `npx -y @yawlabs/npmjs-mcp`. The README documents one environment variable (NPM_TOKEN) to set first. You can also paste the ready-made client config above.

Does npm Registry MCP Server run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to npm Registry MCP Server

Alternatives to npm Registry MCP Server

Maintained security servers if npm Registry MCP Server isn't the fit.

Pairs well with

Servers that cover what npm Registry MCP Server doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Webcheck · Pyobfus MCP · VMware NSX Security · 1Claw Vault · Cybersec Toolkit

More TypeScript MCP servers · PostgreSQL MCP Server (yawlabs) · Redis MCP Server · SSH MCP Server (yawlabs) · Tailscale MCP Server · Thebrain · see all