ls-mcp
MCP server by Liran Tal (prominent Node.js security researcher) providing supply chain security analysis for npm packages — scanning for malicious packages, known vulnerabilities, typosquatting risks, and suspicious package metadata. Integrates package security intelligence into AI development workflows to help agents make safer dependency choices.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Security tool from Node.js security expert. No credentials. Public npm registry queries only. HTTPS. Low attack surface.
⚡ Reliability
Best When
A developer using an AI coding assistant wants to check npm package safety before installing dependencies — preventing supply chain attacks through proactive package scanning.
Avoid When
You need comprehensive CVE scanning across multiple package ecosystems — use Snyk or Dependabot for broader coverage.
Use Cases
- • Scanning npm packages for supply chain risks before installation from security-aware coding agents
- • Checking package authenticity and detecting typosquatting from DevSecOps agents
- • Integrating package security checks into CI/CD pipelines from automation agents
- • Auditing project dependencies for known malicious packages from audit agents
- • Evaluating npm package trustworthiness before adding to projects from developer assistants
Not For
- • Non-npm ecosystems (pip, cargo, etc.) without additional tooling
- • Runtime vulnerability scanning (use Snyk, OWASP Dependency-Check for CVE scanning)
- • Production monitoring (this is a pre-installation analysis tool)
Interface
Authentication
No authentication required. Queries public npm registry and security intelligence sources. No API key needed for basic operation.
Pricing
Free open source security tool from Liran Tal (Snyk security researcher and Node.js security expert).
Agent Metadata
Known Gotchas
- ⚠ Package analysis results are point-in-time — a package may become malicious after scanning
- ⚠ npm registry rate limits may affect batch scanning of many packages
- ⚠ Security intelligence data freshness depends on upstream sources — not always real-time
- ⚠ Community tool by prominent security researcher — higher quality than average community MCP
- ⚠ Focus is npm ecosystem — does not cover Python, Rust, Go, or other package managers
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for ls-mcp.
Scores are editorial opinions as of 2026-03-06.