Npmguard MCP Server

What is Npmguard?

Npmguard is a native pre-install risk gate for npm packages, packaged as an MCP tool for AI coding agents. It pulls data from the npm registry, OSV.dev (including the MAL-* malware namespace), and GitHub repo signals in parallel, computes a composite risk score, and returns an ok / warn / block verdict before lifecycle scripts can execute. The server is a single static Rust binary distributed via GitHub Releases (not npm) so the gate itself cannot be compromised by the npm supply chain it protects against.

How to use Npmguard?

Add Npmguard to your MCP host (Claude Code, Cursor, Windsurf) by adding a JSON entry with the path to the npmguard-mcp binary. It exposes one tool: install_package(name, version?) which returns { level, score, signals, recommendation }. AI agents can use the structured tool response to decide whether to proceed with an installation. The binary is installed by downloading a prebuilt release from GitHub Releases for your platform.

Key features of Npmguard

• Pre-install risk scoring with composite score and verdict
• Eight risk signals: LifecycleScripts, PackageAge, MaintainerChurn, SoleMaintainer, RepoHealth, Typosquat, KnownCve, Deprecated
• Integrates OSV.dev malware namespace (MAL-*) for known malicious packages
• Single static Rust binary distributed outside npm for supply chain security
• MCP tool returns structured signals for AI agent decision-making
• Prebuilt binaries for macOS, Linux, and Windows

Use cases of Npmguard

• AI coding agents evaluating npm packages before permitting installation
• Blocking typosquat attacks and known malware before lifecycle scripts execute
• Manual risk assessment via npmguard install <package> (supports CLI)