NPM Plus MCP Server: Security & Bundle Analysis

Overview

NPM Plus MCP Server is a lightweight Model Context Protocol (MCP) server designed to help developers secure JavaScript projects inside MCP-enabled editors and workflows. It provides automated vulnerability scanning, dependency management intelligence, and bundle analysis so code-assist models can reason about package contexts and suggest safe, minimal changes.

The server acts as a local service that ingests project metadata (package.json, lockfiles, built bundles) and exposes structured manifests and analysis results. These outputs are consumed by MCP-aware tools and editor integrations to power secure code completion, dependency upgrades, and pull-request automation without sending sensitive repository content to external services.

Features

• Scans package.json and lockfiles for known vulnerabilities and risky transitive dependencies
• Analyzes built bundles to detect duplicate modules, large assets, and tree-shaking regressions
• Produces a structured MCP manifest describing dependencies, versions, and risk metadata
• Intelligent dependency suggestions: minimal upgrades, replace-with-safer alternatives, or patch instructions
• Caching and local artifact storage to reduce latency in interactive editor sessions
• Configurable vulnerability sources and scanning policies
• Simple HTTP API for editor integrations or CI pipelines

Installation / Configuration

Clone the repository and install dependencies:

git clone https://github.com/shacharsol/js-package-manager-mcp.git
cd js-package-manager-mcp
npm install

Start the server locally (default port 3000):

npm run start
# or
node ./src/server.js

Environment variables (examples):

export MCP_PORT=3000
export MCP_API_KEY="replace-with-secure-key"
export MCP_CACHE_DIR="/var/tmp/mcp-cache"
# If configured to use an external vulnerability DB
export VULN_DB_API_KEY="your-vuln-db-key"

Sample JSON configuration (mcp.config.json):

{
  "port": 3000,
  "apiKey": "replace-with-secure-key",
  "vulnerabilitySources": ["npm-audit", "oss-index"],
  "cache": {
    "enabled": true,
    "path": "./.mcp-cache"
  },
  "bundleAnalysis": {
    "enabled": true,
    "maxAssetSizeKB": 500
  }
}

Security note: always protect the API key and restrict access to the MCP server in multi-user environments (use a local-only socket, firewall rules, or process user isolation).

Available Resources

Common HTTP endpoints exposed by the MCP server (example usage; adjust paths per your installation):

• GET /mcp/manifest
  • Returns a JSON manifest describing the project dependencies, direct vs transitive, resolved versions.
• POST /mcp/scan
  • Accepts package.json and lockfile payloads; returns vulnerability findings and suggested fixes.
• POST /mcp/analyze
  • Accepts a bundle or source map for static bundle analysis; returns duplicated modules, large assets, and tree-shake inefficiencies.
• POST /mcp/install
  • Optional helper to produce a deterministic install plan (dry-run) or generate recommended package changes.

Example curl request to get the manifest:

curl -H "Authorization: Bearer $MCP_API_KEY" \
     http://localhost:3000/mcp/manifest

Return formats are JSON and designed to be consumed by language models or editor extensions.

Use Cases

1. Editor-aware vulnerability hints

   • An MCP editor requests /mcp/manifest when the developer opens a workspace. The editor overlays inline warnings for files that import packages flagged by the server, and suggests precise upgrade or patch instructions.

2. CI pre-merge scanning

   • A CI job POSTs the repository lockfile to /mcp/scan. The server returns a summarized report (count by severity, vulnerable paths) which the CI uses to block merges or create automated remediation PRs.

3. Bundle bloat investigation

   • A developer uploads a production bundle (or source map) to /mcp/analyze. The server reports duplicate modules, unexpected large assets, and points to the tree that introduced each module, helping reduce bundle size.

4. Dependency change proposals

   • When an AI assistant suggests adding or upgrading a dependency, it first queries the MCP server for minimal safe versions and known vulnerability notes, then proposes a change that the developer can apply with confidence.

Tables & Quick Reference

Supported inputs and typical outputs:

Final notes

The MCP server is intended to be run as a local or trusted network service and integrated into editor or CI workflows to enhance security-aware developer tooling. Configure vulnerability sources, caching, and access controls to fit your team’s security posture.