npm-helper-mcp

The server uses Zod for input validation and implements rate limiting for external API calls to the npm registry. It adheres to MCP protocol best practices by logging all server-side messages exclusively to stderr. No direct use of 'eval' or obvious code obfuscation is present, and no hardcoded secrets are identified. However, its 'run_doctor' tool can execute arbitrary 'doctorInstall' and 'doctorTest' scripts, and other tools can modify 'package.json' files based on the 'packagePath' argument. This powerful functionality, while intended for dependency management, necessitates deployment in trusted environments and careful consideration of inputs provided by the calling LLM or framework to prevent unintended script execution or file modifications.