Loading ToolBench
MCP server that exposes NPM registry operations as tools for AI agents, including package info, search, download stats, version management, dist-tags, user profiles, access control, organization/team management, security audits, hooks, and CouchDB operations.
NPM Registry MCP Server has broad tool coverage (31 tools) with mostly complete schema definitions and descriptions. However, there are systemic quality issues: (1) Descriptions lack LLM optimization, many are verbose and exceed the 200-char guidance without clear 'WHEN to use' framing; (2) Parameter descriptions are inconsistent, some tools have detailed parameter docs while others are sparse; (3) Output schemas are documented only in test fixtures, not in the tool registration code itself; (4) Several parameters lack type constraints (enums, ranges) where they should exist; (5) Error handling is minimal, no recovery guidance or categorization present. The server demonstrates competence in schema structure and naming discipline, but falls short of production-grade LLM-optimization patterns. Average per-tool score: 62.
Run security audit on package dependencies. Checks npm advisory database for known vulnerabilities.
Get details for a specific security advisory by ID.
Get the sequence of document changes from the CouchDB registry (useful for implementing continuous replication).
Delete a dist-tag from an NPM package. Requires authentication token configured at server level. WARNING: Deleting 'latest' tag may cause issues.
Get a specific dist-tag value for an NPM package. Returns the version string that the tag points to.
Set or update a dist-tag for an NPM package to point to a specific version. Requires authentication token configured at server level.
STDIO-only transport: Server is not remotely accessible and cannot be used with hosted MCP clients. This is a hard architectural limitation that caps protocol readiness.
Descriptions lack LLM optimization. Many descriptions are overly verbose (100-150 chars) without clear 'WHEN to use' or 'WHY choose this over related tools' framing. Example: npm_download_stats description is 109 chars but buries the key distinction (always hits npmjs.org) deep in the text. Should lead with differentiator.
Missing output schema documentation. Tool descriptions promise output (e.g., npm_search returns 'matching packages with relevance scores') but the actual response structure is inferred only from test fixtures in tools_all_test.go. LLMs cannot plan multi-step tool chains without documented output schemas.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 59 | 2026-07-28+ | v2 |
Get distribution tags (dist-tags) for an NPM package. Returns version aliases like 'latest', 'next', 'beta', etc.
Get daily download counts for an NPM package over a time period. Returns an array of daily download counts, useful for trend visualization. Note: always queries api.npmjs.org regardless of mirror/registry settings.
Get download count statistics for an NPM package over a time period. Note: always queries api.npmjs.org regardless of mirror/registry settings.
Get details for a specific webhook hook by ID.
List all webhook hooks configured for the authenticated user.
Get the latest version number of an NPM package. Lightweight and fast — only queries the dist-tags endpoint.
List all available NPM mirror sources with their URLs, regions, and descriptions. Useful for users in China who need faster access.
Get information about a specific NPM organization.
List members of an NPM organization.
List packages published by an NPM organization.
Get complete metadata for an NPM package including all versions, README, maintainers, and dependencies. WARNING: Response can be very large (10MB+). Use npm_package_summary for most queries.
Get access/permissions settings for an NPM package. Requires authentication token.
List collaborators for an NPM package. Requires authentication token.
Get lightweight metadata for an NPM package (name, description, dist-tags, version list). Much smaller response than npm_package. Recommended for most queries.
Get NPM registry status and statistics including total package count, disk size, and update sequence.
Search NPM packages by keyword with optional pagination and score weighting. Returns matching packages with relevance scores.
Get list of users who starred a specific NPM package.
Get list of packages starred by a specific NPM user.
List teams in an NPM organization.
List members of a team within an NPM organization.
List all NPM access tokens for the authenticated user. Requires authentication token.
Get user profile information from NPM registry. Requires authentication token.
Get metadata for a specific version of an NPM package, including dependencies, scripts, and distribution info.
List all published version numbers of an NPM package, sorted in ascending order.
Check current NPM authentication status. Returns the authenticated username. Requires the server to be configured with an auth token (--token flag or NPM_TOKEN env var).
No pagination or result-limiting guidance. Tools like npm_search accept 'limit' parameter but descriptions do not state the default (stated as 20 in parameter description) or maximum. npm_search, npm_package, and npm_audit should document result caps and pagination patterns to prevent context window exhaustion.
Inconsistent parameter descriptions. Some tools (npm_search, npm_download_stats, npm_download_range) have rich parameter docs with constraints and enums; others (npm_user_get, npm_package_access, npm_org_get) have minimal or missing parameter descriptions. 'name' parameter appears 20+ times with varying documentation quality.
No error recovery guidance. All 31 tools are READ_ONLY or WRITE/DESTRUCTIVE, but descriptions provide zero recovery hints. Example: npm_dist_tag_delete warns 'Deleting latest tag may cause issues' but does not suggest 'If this fails, call npm_dist_tag_set to restore the tag.' No tool documents what errors are possible or how to recover.
Parameter constraints missing. npm_download_stats and npm_download_range accept 'period' as an enum, which is good. However, npm_search accepts 'quality', 'popularity', 'maintenance' as unbounded numbers (0.0-1.0) with no explicit min/max schema constraints. LLMs may pass out-of-range values without validation.
Ambiguous tool naming: npm_dist_tag_get, npm_dist_tag_set, npm_dist_tag_delete all operate on dist-tags. While naming is internally consistent, the descriptions do not clearly explain when to use each vs. npm_dist_tags (list all). LLMs may conflate them.
Scoped package notation mentioned but not validated. Tool descriptions reference '@nestjs/core' and '@scope/package' syntax, but descriptions do not explain how the tool handles scoped packages. No validation rules are stated, LLMs may pass invalid scope syntax.
No confirmation or dry-run for destructive operations. npm_dist_tag_delete and npm_dist_tag_set are WRITE/DESTRUCTIVE but lack a dry-run mode or confirmation step. An LLM mistake deletes a critical tag with no undo. Consider adding a 'confirm' parameter or separate 'confirm_*' tools.