Npm Advisor MCP

npm-advisor-mcp

A Model Context Protocol (MCP) server that acts as an intelligent npm package advisor. Describe the feature you need, and it will search the registry, compare candidates, audit for vulnerabilities, and recommend the best library based on bundle size, popularity, maintenance, TypeScript support, and more.

---

Features

• Search by feature — describe what you need (e.g., "date manipulation", "PDF generation") and get ranked results
• Side-by-side comparison — compare 2–5 packages on key metrics in a clean table format
• Deep package details — full breakdown of a single package: README, dependencies, scores, links
• Weighted recommendations — algorithm-driven pick with dynamic weights per use case (browser, Node.js, React, CLI)
• Security audit — check for known CVEs with severity breakdown and patch availability
• Deprecation check — detect deprecated, abandoned, or unmaintained packages with a clear verdict
• Find alternatives — discover competing packages when migrating away from a deprecated library
• Install command generator — copy-paste commands for npm, yarn, pnpm, and bun with peer deps included
• Changelog viewer — fetch recent release notes from GitHub, GitLab (cloud + self-hosted), or Bitbucket
• Technical Q&A — ask specific questions about a package and get contextual answers from its metadata
• In-memory caching — all API responses are cached with TTL to eliminate redundant network calls

---

Architecture

npm-advisor-mcp/

├── package.json # Project manifest (ESM, Node 18+) ├── tsconfig.json # TypeScript strict config (ES2022/Node16) ├── mcp-config.json # Ready-to-use Kiro MCP configuration snippet ├── src/ │ ├── index.ts # MCP server entry point (stdio transport) │ ├── models/ │ │ └── types.ts # Shared interfaces and scoring weights │ ├── services/ │ │ ├── cache.ts # In-memory TTL cache (2/5/10 min tiers) │ │ ├── npm-registry.ts # registry.npmjs.org client │ │ ├── npm-audit.ts # npm security advisory API client │ │ ├── bundlephobia.ts # Bundle size data (bundlephobia.com) │ │ ├── npms-io.ts # Quality/maintenance/popularity scores │ │ └── scoring.ts # Weighted recommendation engine + license checker │ └── tools/ │ ├── search-packages.ts │ ├── compare-packages.ts │ ├── package-details.ts │ ├── recommend.ts │ ├── resolve-doubt.ts │ ├── audit-package.ts │ ├── find-alternatives.ts │ ├── check-deprecation.ts │ ├── generate-install-command.ts │ └── get-changelog.ts └── dist/ # Compiled output (generated by npm run build)

---

Prerequisites

• Node.js 18+ (uses native fetch)
• npm 9+

No API keys required — all data sources are public and free.

---

Installation

cd C:\Users\617500221\Projects\AI-Tools\npm-advisor-mcp

npm install npm run build

---

Configuration (Kiro MCP)

Add this to your ~/.kiro/settings/mcp.json inside the "mcpServers" object:

"npm-advisor": {

"command": "node", "args": [ "C:\\Users\\617500221\\Projects\\AI-Tools\\npm-advisor-mcp\\dist\\index.js" ], "disabled": false, "autoApprove": [ "search_packages", "compare_packages", "get_package_details", "recommend_package", "resolve_technical_doubt", "audit_package", "find_alternatives", "check_deprecation", "generate_install_command", "get_changelog" ] }

After saving, the server will appear in the Kiro MCP panel and reconnect automatically.

---

Tools Reference

1. search_packages

Search npm for packages matching a feature or keyword.

Example prompt:

"Search for packages that handle PDF generation in Node.js"

Returns: Ranked list with description, weekly downloads, gzip size, quality/maintenance/popularity scores, and tree-shaking support.

---

2. compare_packages

Compare 2–5 packages side-by-side on all key metrics.

Example prompt:

"Compare dayjs, date-fns, and moment for date manipulation"

Returns: Markdown table with version, gzip size, minified size, downloads/week, TypeScript support, tree-shaking, dependency count, maintenance score, quality score, last publish date, and license.

---

3. get_package_details

Deep dive into a single package with full metadata.

Example prompt:

"Get details about the zod package"

Returns: Version, description, quick stats table (downloads, sizes, deps, TS support, license, publish date), quality scores, dependency list, peer dependencies, links, keywords, and a README excerpt.

---

4. recommend_package

Get a weighted recommendation from a list of candidates. Scoring weights automatically adjust based on your target environment.

Example prompt:

"Recommend a date library from dayjs, date-fns, moment, and luxon for a browser app — must be under 10KB gzipped"

Returns: Winner with rationale, runner-up alternatives, a detailed score breakdown table, and a license compatibility column.

Default Scoring Weights (general)

Use Case Weight Adjustments

---

5. resolve_technical_doubt

Answer a specific technical question about a package.

Example prompts:

"Does dayjs support timezone conversion out of the box?"

"Is lodash tree-shakeable?"

"What are the peer dependencies of @angular/material?"

"Is chalk still actively maintained?"

Returns: Contextual answer pulling from metadata, bundle analysis, dependency tree, scores, and README content. Automatically detects question category (size, TypeScript, dependencies, maintenance, tree-shaking) and surfaces relevant data.

---

6. audit_package

Check a package for known security vulnerabilities.

Example prompt:

"Are there any known vulnerabilities in lodash?"

Returns: Total vulnerability count, severity breakdown (critical/high/moderate/low), per-CVE details with affected version ranges, patch availability, advisory links, and a deprecation warning if applicable.

---

7. find_alternatives

Find similar or competing packages as alternatives to a given one.

Example prompts:

"Find alternatives to moment.js"

"What can I use instead of request?"

Returns: Ranked list of alternatives with descriptions, weekly downloads, bundle sizes, quality scores, and tree-shaking support. Flags if the original package is deprecated.

---

8. check_deprecation

Detect if a package is deprecated, unmaintained, or potentially abandoned.

Example prompts:

"Is request still maintained?"

"Is moment.js deprecated?"

Returns: npm deprecation flag, days since last publish, maintenance score, weekly downloads, and a clear verdict — actively maintained / moderately stale / potentially abandoned / officially deprecated.

---

9. generate_install_command

Generate ready-to-paste install commands across all major package managers.

Example prompts:

"Give me the install command for @tanstack/react-query"

"How do I install eslint as a dev dependency with pnpm?"

Returns: Install commands for npm, yarn, pnpm, and bun. Automatically appends peer dependencies and adds a separate @types/ install block if the package lacks built-in TypeScript types.

---

10. get_changelog

Fetch recent release notes for a package from its git repository. Supports GitHub, GitLab (cloud and self-hosted), and Bitbucket.

Example prompts:

"What changed in the last few versions of zod?"

"Show me the recent releases for vite"

"What's new in @ATLAS/info-panel?"

Returns: Release history with version tags, publish dates, and formatted release notes (truncated at 800 chars per release).

Git host detection

The tool reads the repository field from the package's package.json and auto-detects the host:

Note for private/internal packages: The tool reads the repository field from the package metadata fetched from your registry. If your internal package.json doesn't include a repository field, or uses an SSH URL like git@internal-git:atlas/info-panel without a recognisable hostname, the tool won't be able to