NPMScan
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
likely compatible
Answered an MCP initialize with no credentials; use auth 'None'.
Rule R2a · what this means · Not tested in Copilot Studio.
| Registry name | io.github.salemalem/npmscan |
| Endpoint used for verdict | https://npmscan.com/api/mcp |
| Transports | streamable-http |
| Auth (Copilot Studio setting) | None (open) |
| Last endpoint check | 2026-10-20T18:17:11Z · initialize OK |
| GitHub | salemalem/npmscan-mcp-plugin |
| Website | https://npmscan.com |
| Version | 3.1.2 |
| Registry updated | 2026-10-10 |
Track changes like this weekly. New Copilot-ready MCP servers, breakages and auth changes, in one short email.
Is this wrong or out of date? Email us. Data built 2026-10-20.