Best npm MCP servers for Cursor and Claude

There is no official npm Inc MCP. The right server depends on the job. Socket wins supply-chain scores through depscore on the hosted URL https://mcp.socket.dev/. Pipeworx mcp-npm wins live registry search, version lists, and raw download counts for last-day through last-year. mcp-server-npm-plus wins local, keyless research that also hits Bundlephobia. NPMLens wins README text and usage snippets. Trends MCP is first only when the agent needs multi-year npm download growth on source npm, with several windows in one request, plus the same payload shape as Google Search. The older mcp-server-npm package returns 404 on the npm registry, so that install JSON is a dead end.

Which npm MCP should Cursor load first?

Load the server that owns the next tool call, not a generic "npm" label. A Cursor agent that is about to add a dependency needs Socket for scores, or Pipeworx / npm-plus / NPMLens for search and metadata. An agent that is writing a grow-or-skip note on an exact package name needs Trends MCP. npm Inc does not publish a first-party MCP. Directory pages that call Socket the "official npm MCP" are describing Socket's own product, not the registry.

Trends MCP does not search the registry, fetch a README, or score a lockfile. Pipeworx and the local npm research servers do not return a 0-100 series next to Google Search. Mixing those jobs in one prompt is how an agent scrapes npmjs.com "to confirm" after it already had a tool for the question.

The GitHub pairing is a separate board. Type GitHub on get_top_trends ranks trending repositories. Source npm on get_growth ranks download movement for one exact package. A repo can trend while downloads stay quiet. The npm trends API for AI agents page is the agent-shaped version of that split.

What does each npm MCP actually expose?

The five servers below were checked on 10 Nov 2026 against each project's README, npm page, GitHub API, and (for Trends MCP) live get_growth. Weekly download counts come from the npmjs.com package pages that day. The npm last-week API for 2-8 Nov 2026 disagreed on three of four packages, so the page figure is the one quoted, with the API print in parentheses.

Socket's GitHub repo SocketDev/socket-mcp showed 141 stars, 47 forks, MIT, not archived, last push 9 Nov 2026. The npm package is @socketsecurity/mcp 0.3.0, last publish 23 Oct 2026. Pipeworx pipeworx-io/mcp-npm showed 0 stars, MIT, last push 9 Nov 2026, package @pipeworx/mcp-npm 0.2.1 published 3 Nov 2026. ofershap/mcp-server-npm-plus showed 1 star, MIT, last npm publish 10 Mar 2026 (1.0.1). rakeshmenon/npmlens-mcp showed 0 stars, MIT, last npm publish 3 Dec 2025 (0.1.12). Stars are a weak ranking signal here. Tool coverage and whether the install still resolves matter more.

Trends MCP Cursor JSON

The Trends MCP for Cursor host page documents url plus transport http on the API host. Connecting is free. Calling is not. The key is a Bearer token from the account page.

{
  "mcpServers": {
    "trends-mcp": {
      "url": "https://api.trendsmcp.ai/mcp",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

npm is a get_growth / get_time_series source, not a get_top_trends board. The keyword must be the exact package name, case-sensitive. react works. React does not. @tanstack/react-query is one keyword. Stripping @ or splitting on / is a different lookup. One keyword per call. Several windows such as 3M and 12M ride in that same request.

Socket hosted JSON

Socket's npm README (accessed 10 Nov 2026) publishes this Cursor block for the public server. OAuth is required on every hosted tool call, including package scoring. No API key is copied for that path.

{
  "mcpServers": {
    "socket-mcp": {
      "type": "http",
      "url": "https://mcp.socket.dev/"
    }
  }
}

The same README's compatibility table, snapshot dated 2 Oct 2026, reports Cursor 3.22.12 hosted HTTP OAuth failed in the tested conditions (organizations stayed Unauthorized). Cursor local stdio with an API token was the path that passed depscore. Check that table before treating the hosted URL as the Cursor default. Socket's pricing page lists the MCP server as included on Free, Team, Business, and Enterprise. Free is $0 per seat per month with 1,000 scans and 500 API requests. Team is $25 per seat per month. Yearly billing is listed as save 20 percent. Check current pricing on socket.dev/pricing before locking a seat count.

depscore takes an array of {ecosystem, depname, version} objects. Default ecosystem is npm. The documented sample scores [email protected] and [email protected] on supply_chain, quality, maintenance, vulnerability, and license. That is the job. It is not download history.

Pipeworx hosted JSON

Pipeworx states it is unofficial and not affiliated with npm. The hosted pack URL lists the five npm tools plus roughly 30 shared gateway tools (ask_pipeworx and the rest). The local npx bridge lists only this pack's tools unless PIPEWORX_META_TOOLS=1.

{
  "mcpServers": {
    "npm": {
      "url": "https://gateway.pipeworx.io/npm/mcp"
    }
  }
}

{
  "mcpServers": {
    "npm": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-npm"]
    }
  }
}

Without a key the npx bridge is capped at 50 calls a day. A free account raises that to 200 a day. Pipeworx pricing (accessed 10 Nov 2026) prices government and open data at $0.005 per request on pay as you go, $0.003 on $49/month, and $0.001 on $99/month. npm Registry traffic is free upstream, so this pack sits on that open-data row. Check current pricing on pipeworx.io/pricing. get_downloads returns raw counts for named periods. It does not return a 0-100 index, and it does not share a payload with Google Search.

mcp-server-npm-plus and NPMLens

ofershap's plus server is the local all-in-one that still resolves on the registry. Tools: search, package_info, downloads, compare_downloads, bundle_size, vulnerabilities, dependency_tree, download_trends. No API key. Last publish 10 Mar 2026, so treat Bundlephobia and advisory links as whatever those public APIs return on the day of the call.

{
  "mcpServers": {
    "npm-plus": {
      "command": "npx",
      "args": ["mcp-server-npm-plus"]
    }
  }
}

NPMLens exposes nine tools, including get_readme and get_usage_snippet. Optional GITHUB_TOKEN only for higher GitHub rate limits. Node.js 18.17 or newer. Last publish 3 Dec 2025.

{
  "mcpServers": {
    "npmlens": {
      "command": "npx",
      "args": ["-y", "npmlens-mcp@latest"]
    }
  }
}

@socketsecurity/mcp weekly volume moved from 151 to 13,474 in 12 months

A Trends MCP get_growth pull on 10 Nov 2026 for keyword @socketsecurity/mcp on source npm returned weekly volume 13,474 on 7 Nov 2026 versus 151 on 8 Nov 2025. Volume growth was 8,823.18 percent. The 0-100 index moved from 0.7 to 65.5 (9,257.14 percent). The same call asked for 3M and YTD in one body: 3M volume 13,474 versus 1,287 on 8 Aug 2026 (946.93 percent); YTD versus 123 on 3 Jan 2026 (10,854.47 percent). metadata.total_data_points was 260. Extra windows did not add requests. That is the durable contract: one source plus one exact keyword, several presets, volume on npm.

{
  "mode": "get_growth",
  "source": "npm",
  "keyword": "@socketsecurity/mcp",
  "percent_growth": ["3M", "12M", "YTD"]
}

A 12-month pull the same morning on @pipeworx/mcp-npm printed growth 999999 because baseline_volume was 0. Recent volume was 318 on 7 Nov 2026, index 77.9, across 260 points. Quote the volume pair, not the percent, when the baseline is zero. The npm API page is the REST shape for that call. Official raw counts remain at api.npmjs.org/downloads when the ticket wants a date range and nothing else.

Low-volume packages still print huge percents on tiny baselines. @socketsecurity/mcp had a real 151-download baseline. @pipeworx/mcp-npm did not. Both rows are "increase." Only one of them is a story.

Why npx mcp-server-npm fails

ofershap's original README still documents npx -y mcp-server-npm for Claude Desktop and Cursor. On 10 Nov 2026, https://www.npmjs.com/package/mcp-server-npm, https://registry.npmjs.org/mcp-server-npm, and https://api.npmjs.org/downloads/point/last-week/mcp-server-npm all returned 404. The GitHub repo ofershap/mcp-server-npm is still public (0 stars, last push 10 Mar 2026). The package name on the registry is gone.

The successor that still installs is mcp-server-npm-plus. Copy-paste configs that name mcp-server-npm will fail at npx time. Glama and other indexes that still list the old package are stale relative to the registry.

Trends MCP pricing on 10 Nov 2026 llms.txt (Updated 10 Nov 2026) plus the homepage: Free $0 / 100 requests a month; Starter $19 / 1,000; Pro $49 / 5,000; Business $199 / 25,000. Yearly cards Starter $16 / $192, Pro $39 / $468, Business $159 / $1,910, described as 2 months free. Pay-as-you-go packs $15 / 600 credits, $49 / 2,500, $199 / 12,000. 54 data sources across 27 platforms. Five billed tools (get_time_series, get_growth, get_top_trends, get_context, get_reviews) plus free get_usage. MCP get_top_trends is 1 request per 10 rows; REST one call is one request. Failed calls are free. Check current pricing on the pricing page before locking a plan.

FAQ

Is there an official npm MCP server?

No. npm Inc does not publish a first-party MCP. Socket is Socket's MCP, included on Socket plans, and it scores packages rather than searching the registry. Pipeworx labels mcp-npm as unofficial. Trends MCP is a trend-data product with source npm as one of 54 data sources.

Which npm MCP is best for Cursor overall?

None of them wins every job. Socket is the security pick, with the caveat that Socket's own 2 Oct 2026 test snapshot reported hosted OAuth failing on Cursor 3.22.12. Pipeworx or npm-plus is the registry-search pick. Trends MCP is the download-growth pick, using the Cursor JSON on the Trends MCP for Cursor page. Load two servers if the agent both scores a lockfile and grow-checks a name.

Can Trends MCP search for packages by keyword?

No. get_growth and get_time_series need the exact package name. There is no search tool on this server. Use Pipeworx search_packages, npm-plus search, or NPMLens search_npm to find a name, then pass that name into Trends MCP if the next question is growth.

How much does an npm growth call cost on Trends MCP?

One successful get_growth call is one request per source, every window included. 3M, 12M, and YTD in one body still count as one npm request. Free includes 100 requests a month. Two packages are two requests. Adding google search on the same name is a second source on that name.

Why do weekly download counts disagree between npmjs.com and the last-week API?

On 10 Nov 2026 the npmjs.com pages showed @pipeworx/mcp-npm 451, mcp-server-npm-plus 55, and npmlens-mcp 9. The npm last-week API for 2-8 Nov 2026 printed 318, 61, and 12. @socketsecurity/mcp matched at 13,540. Cite the package page when those two disagree, and keep the API window in the sentence.

Sources (accessed 10 Nov 2026): Socket MCP guide, @socketsecurity/mcp on npm, Socket pricing, pipeworx-io/mcp-npm, @pipeworx/mcp-npm on npm, Pipeworx pricing, mcp-server-npm-plus, npmlens-mcp, npm last-week API for 2-8 Nov 2026, Trends MCP llms.txt Updated 10 Nov 2026, live get_growth source npm.