Public assessment

mikusnuz/npm-mcp (@mikusnuz/npm-mcp)

mikusnuz-npm-mcp · v1.2.0 · scanned Aug 3, 2026

What changed in the harness

Selection accuracy 98→100, token cost up 18%, unconfirmed writes 0%→0%.

Category breakdown

Where the score comes from.

Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.

01Safety

0.0 / 30

0.0 out of 30

02Legibility

21.1 / 30

21.1 out of 30

03Economics

17.3 / 20

17.3 out of 20

04Discoverability

14.0 / 20

14.0 out of 20

Highest-impact fix

Estimated gain +30 points

Add explicit identity and permission preflight tools

Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.

Description evidence

Defects and rewrites.

38 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.

Tool	Defect types	Suggested rewrite
`publish`	name_restates_behavior no_return_description	Publish the package in the given directory to the npm registry, using the optional dist-tag (default latest), access level for scoped packages, and 2FA one-time password when required; dryRun previews without publishing. Returns the published version and registry details.
`version`	name_restates_behavior no_return_description	Bump the package version in package.json by a release type (patch, minor, major, or a prerelease type with optional preid), and optionally skip creating a git tag. Returns the new version number.
`view`	name_restates_behavior no_return_description	Fetch metadata for the given package from the npm registry, optionally limited to a specific field such as versions or dist-tags. Returns the requested package information.
`search`	name_restates_behavior no_return_description	Find packages on the npm registry matching the given query, with an optional result limit (default 20). Returns a list of matching packages with their metadata.
`unpublish`	no_return_description	Remove a package version from the npm registry (specify pkg@version, or use force to remove the entire package), providing a 2FA one-time password when required. Returns the result of the removal.
`deprecate`	name_restates_behavior no_return_description	Mark the given package version range as deprecated so installers see the supplied message; an empty message removes the deprecation, and a 2FA one-time password may be required. Returns the updated list of deprecated versions.
`owner`	name_restates_behavior params_unexplained no_return_description	List, add, or remove maintainers for the specified package using the action ls, add, or rm (user is required for add/rm), with a 2FA one-time password when enabled. Returns the current or updated list of package owners.
`dist-tag`	no_return_description	List, add, or remove dist-tags for a package using the action ls, add, or rm; for add, the package must include the version (e.g. pkg@1.0.0) and the tag name is required. Returns the current dist-tag mapping.
`pack`	no_return_description	Bundle the package directory into a publishable .tgz tarball, or use dryRun to only list the files that would be included without creating the tarball. Returns the tarball filename and its contents.
`whoami`	no_return_description	Report the npm username currently authenticated for the registry; if none is authenticated, guidance is to set the NPM_TOKEN env var in the MCP config. Returns the authenticated username.
`init`	no_return_description	Create a new package.json in the given directory, optionally scoping the package under a name like @myorg. Returns the created package.json.
`audit`	name_restates_behavior no_return_description	Scan the dependencies of the package in the given directory for known security vulnerabilities, optionally auto-fixing them, filtering by minimum severity level, and limiting to production dependencies. Returns the audit report with vulnerable packages and advisories.
`outdated`	no_return_description	Compare the dependencies in the given directory (or global packages) against the registry to find outdated ones, optionally showing extended information. Returns a report of outdated packages with current, wanted, and latest versions.
`ls`	no_return_description	Show the dependencies installed in the given project directory, optionally filtered to a specific package, limited by tree depth (default 0), including all dependency levels, global packages, or production-only. Returns the dependency tree or list with installed versions.
`install`	name_restates_behavior no_return_description	Install the given packages (or all dependencies from package.json when none are given) into the directory, optionally saving to devDependencies, pinning exact versions, installing globally, or dry-running to preview. Returns the resulting dependency tree.
`uninstall`	no_return_description	Remove the specified packages from the project in the given directory (or from global), updating the resolved dependency tree. Returns the remaining dependency tree.
`update`	name_restates_behavior no_return_description	Upgrade the specified packages (or all when none are given) in the directory to the latest semver-compatible version, optionally targeting global packages or dry-running to preview changes. Returns the updated dependency tree.
`access`	params_unexplained no_return_description	List, get, set, grant, or revoke access for the specified package on the npm registry: use level (public/restricted) for set, team and permission (read-only/read-write) for grant/revoke, and provide a 2FA one-time password when enabled. Returns the access status or the result of the change.
`token`	no_return_description	List npm access tokens or revoke one by its token ID (token required for revoke), providing a 2FA one-time password when enabled. Returns the list of tokens or the revocation result.
`ping`	no_return_description	Test connectivity to the npm registry. Returns a confirmation that the registry is reachable, and errors if it is not.
`bugs`	params_unexplained no_return_description	Retrieve the bug-tracker URL for the given package. Returns the URL where bugs for that package are reported.
`repo`	params_unexplained no_return_description	Retrieve the source repository URL for the given package. Returns the repository URL.
`docs`	params_unexplained no_return_description	Retrieve the documentation URL for the given package. Returns the documentation URL.
`diff`	name_restates_behavior no_return_description	Compare two package specs (e.g. pkg@1.0.0 vs pkg@2.0.0), either via the specs array or the package range, or compare a local package in the given path against its registry version; diffNameOnly limits output to changed file names. Returns the list of changed files and details.
`pkg`	no_return_description	Get, set, or delete a field in the package.json of the given directory using dot-notation like scripts.build; value is required for set and must be JSON for objects/arrays. Returns the field value for get, or confirmation of the change.
`fund`	no_return_description	Show funding information for the package at the given path, or for a specific named package within it. Returns a summary of available funding sources (e.g., GitHub sponsors, Open Collective) for the relevant packages.
`dedupe`	no_return_description	Reduce duplication in the dependency tree at the given path by hoisting shared dependencies. Returns a report of the deduplication changes applied (or that would be applied when dryRun is set).
`explain`	name_restates_behavior no_return_description	Trace why a specific package is present in the dependency tree at the given path by following the dependency chain back to its roots. Returns the full chain of dependents that pulled that package into the install.
`sbom`	name_restates_behavior no_return_description	Generate a Software Bill of Materials document for the project at the given path, using the selected format (cyclonedx or spdx, default cyclonedx) and optionally restricted to production dependencies. Returns the SBOM document in the requested format.
`profile`	name_restates_behavior no_return_description	Get or set the authenticated npm user's registry profile fields (such as email, fullname, homepage). With the get action, returns the value of the requested field; with set, updates the given field to the value provided (optionally guarded by a 2FA one-time password).
`ci`	no_return_description	Clean install dependencies from the lockfile at the given path to produce a reproducible build for CI environments, removing the existing install first. Returns the npm install output and exit status.
`run-script`	name_restates_behavior no_return_description	Run a script declared in the package.json at the given path, passing any provided args to it. If no script name is given, returns the list of available scripts; otherwise returns the script's output and exit status.
`doctor`	no_return_description	Run diagnostics checking the npm configuration, cache, and installed packages at the given path for common problems. Returns a list of health checks with their results, warnings, and any errors encountered.
`cache`	name_restates_behavior no_return_description	Manage the npm cache: clean clears cached data (requires force), verify checks the integrity of cached data, and ls lists cached contents. Returns the outcome and details of the requested cache action.
`config`	no_return_description	View npm configuration values without modifying anything. With the list action, returns all effective config settings; with the get action and a key, returns the value for that specific config key.
`prune`	no_return_description	Remove extraneous packages not listed in package.json at the given path; setting production also removes devDependencies, and dryRun previews changes without applying them. Returns a list of the packages removed (or that would be removed).
`link`	no_return_description	Create a symlink to the package at the given path so it can be used as a local dependency during development; if a package name is given, link that package instead, otherwise link the current directory globally. Returns the location of the created link.
`query`	name_restates_behavior no_return_description	Query the installed dependency tree at the given path using CSS-like selectors such as ':root > .prod', '.dev', or '#lodash'. Returns the list of packages matching the given selector.

Selection evidence

Confusable tool pairs.

5 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.

Tool A	Tool B	Confidence	Why they collide
`unpublish`	`deprecate`	medium	A task like 'remove version 1.0.0' or 'stop people from using this version' could map to either tool, since both act on a package version to discourage or eliminate its use; an agent reading 'remove a package version' literally may pick unpublish while a safer reading picks deprecate.
`unpublish`	`uninstall`	medium	A generic task like 'remove package foo' is ambiguous: uninstall removes a dependency from a local project while unpublish removes it from the registry; the descriptions disambiguate only if the agent reads the 'registry' vs 'project' qualifiers.
`repo`	`docs`	medium	Both simply 'get the URL for a package', so a task like 'give me the link for library X' or 'where can I find package X online' could make an agent grab the wrong one; users often conflate repo READMEs with documentation pages.
`bugs`	`docs`	low	Both fetch a package-specific URL, and a vague request like 'get me information/links for package X' could be routed to either, though a task mentioning issues/reporting would disambiguate toward bugs.
`bugs`	`repo`	low	Both return a package URL, so a vague 'get me the link/page for package X' could pick the wrong one, though requests mentioning source code vs. issue tracking are clearly distinct.

Compare the field

One score is useful.
The evidence makes it actionable.

Back to the leaderboard