briefkin

Code · 1 skill

npm MCP: connect it to Claude Code, plus ready-made skills

Pull weekly downloads, new versions, deprecations and npm audit results for your packages and dependencies, and report what needs an upgrade.

How to connect npm MCP to Claude Code, Codex or Cursor

  1. MCP server. npm doesn't publish an official MCP server for the registry, and an agent with a shell doesn't need one: the npm CLI and the public endpoints cover these reports. Community servers that search the registry exist, and GitHub's MCP server covers Dependabot alerts for repositories on GitHub.
  2. npm CLI and public APIs. Run npm outdated --json, npm audit --json and npm view <package> time --json in the project, and curl the registry and downloads API; public packages need no token.
  3. Granular access token for private packages. Create a granular access token on npmjs.com with Read-only permission on just the packages or organization the report covers, store it in NPM_TOKEN, and reference it in .npmrc as //registry.npmjs.org/:_authToken=${NPM_TOKEN}.

A read-only granular token can install and inspect packages but never publish; don't reuse a publish token for reports.

1 npm skill

npm weekly downloads

Every Monday: last week's npm downloads summed across your packages, the change against the week before, and the package that moved most.

DevelopersMondays at 9:00Stat tileUses npm.

What agents do with npm

The public registry needs no account for public packages. GET https://registry.npmjs.org/<package> returns dist-tags.latest, every version with its publish date under time, and any deprecated message on a version; the downloads API (https://api.npmjs.org/downloads/point/last-week/<package>, or /downloads/range/2026-09-01:2026-09-30/<package> for daily counts) tracks adoption. Inside a project, npm outdated --json lists each dependency's current, wanted and latest versions, and npm audit --json reports vulnerabilities by severity (low, moderate, high, critical) with the advisory and whether a fix is available.

Maintainers schedule weekly downloads for their packages against the week before. App teams schedule a weekly dependency report: new high and critical advisories, major versions they have fallen behind on, and dependencies that were deprecated.

npmjs.com

Teams that use these

Your npm numbers, on one board with everything else

Skills are free to use with any agent. Briefkin is where their results land: one board for every report, number and question your agents send, with a ping when something needs you.

Join the open betaSee a live demo board

Free during the open beta. No card.