MCP server for managing NPM packages through AI assistants
15 tools with inconsistent quality. Most have basic descriptions (avg ~80 chars, well below 194-char baseline) and parameter descriptions are sparse or missing entirely. Naming follows verb_noun convention (npm-init, npm-install, etc.) which is good, but many parameter descriptions are null or trivial. No output schemas documented. Error handling exists but is generic. Tool definitions are visible in src/index.ts with z.object() schemas, but parameter-level descriptions are largely absent or placeholder.
Audit dependencies for security vulnerabilities
Initialize a new npm package or update an existing one
Install packages as dependencies, devDependencies, or peerDependencies
List all dependencies in your project
Log in to npm registry
Log out from npm registry
Check for outdated packages in your project
Publish the package to npm registry
Parameter descriptions are null or missing across all tools. Schema shows 'description':null for packageName, version, description, author, license, private, type in npm-init and similar patterns in other tools. LLMs cannot infer parameter meaning without explicit descriptions.
No output schemas documented for any tool. Tool descriptions do not specify what fields are returned, what structure the response has, or what IDs/references are available for chaining. Agents cannot plan downstream calls.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Run an npm script from package.json
Search for packages on npm registry
Add or update npm scripts in package.json
Remove packages from your project
Update packages to their latest versions
View detailed information about a package
Display the currently logged-in npm user
Tool descriptions are generic and under 100 chars (avg ~80 chars vs 194-char baseline). E.g., 'Initialize a new npm package or update an existing one' lacks context on when to use it, what happens on success, or prerequisites. Descriptions should be 50-200 chars and answer WHAT, WHEN, and WHAT RETURNS.
Destructive/irreversible operations (npm-publish, npm-uninstall) lack confirmation or dry-run support. Agents can accidentally publish to npm or delete dependencies without a safety gate. No confirmation_request pattern implemented.
npm-login and npm-logout expose registry URLs as parameters but do not document authentication flow, credential storage, or how the server manages npm auth state. Credentials may leak into logs if not handled server-side.