{
  "id": 19486228,
  "title": "How to Build an MCP Server That Checks npm Packages Before AI Installs Them",
  "url": "https://urgent.news/2026/11/11/how-to-build-an-mcp-server-that-checks-npm-packages-before-ai",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-11T07:39:09.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/how-to-build-an-mcp-server-that-checks-npm-packages-before-ai-installs-them?source=rss"
  },
  "original_language": "en",
  "account": "The article describes the process of creating a Cloudflare Workers-based MCP (Model Context Protocol) server called pkgscout. This server checks npm packages before AI coding assistants install them, ensuring they are real, not abandoned, and not traps. The server provides two tools: inspect_package and check_vulnerabilities.\n\nInspect_package determines if a package exists, its latest version, weekly downloads, license, repository, and if it's deprecated. If the package name doesn't exist, it attempts to find the likely intended package. Check_vulnerabilities compares exact versions against npm's advisory database, similar to npm audit.\n\nThe server utilizes the July 2026 Stateless MCP spec, which eliminates the need for maintaining client-server sessions. Each request is self-contained, making it ideal for Cloudflare Workers. The server is written using TypeScript SDK v2 and hosted for free without requiring API keys.\n\nThe article highlights challenges encountered during development. Initially, fetching the full package document (packument) for every lookup proved inefficient, especially for larger packages with extensive version histories. To optimize performance, the server now requests only the /latest manifest, significantly reducing the amount of data processed.\n\nAnother issue involved deprecated packages. The search endpoint provided by npm's registry ranked them lower, making them less likely to appear in search results. To address this, the server incorporated data from npm's downloads API as a fallback, ensuring deprecated packages were flagged appropriately.\n\nOverall, the process of building pkgscout involved overcoming technical hurdles while ensuring the server remains lightweight, efficient, and effective in preventing AI from installing potentially problematic npm packages.",
  "summary": "Build a remote MCP server on Cloudflare Workers that checks npm packages for typos, deprecation and known vulnerabilities before your AI installs them.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}