@yawlabs/npmjs-mcp 0.11.4 → 0.11.6

package/README.md

@@ -5,7 +5,7 @@
 [![GitHub stars](https://img.shields.io/github/stars/YawLabs/npmjs-mcp)](https://github.com/YawLabs/npmjs-mcp/stargazers)
 [![CI](https://github.com/YawLabs/npmjs-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/YawLabs/npmjs-mcp/actions/workflows/ci.yml) [![Release](https://github.com/YawLabs/npmjs-mcp/actions/workflows/release.yml/badge.svg)](https://github.com/YawLabs/npmjs-mcp/actions/workflows/release.yml)
 
-**Run npm registry operations from Claude Code, Cursor, and any MCP client.** 63 tools covering the full registry surface: package intelligence, security audits, dependency analysis, org/team management, and the write ops that normally fight you locally (`npm deprecate`, `npm dist-tag`, `npm owner`, `npm unpublish`).
+**Run npm registry operations from Claude Code, Cursor, and any MCP client.** 64 tools covering the full registry surface: package intelligence, security audits, dependency analysis, org/team management, and the write ops that normally fight you locally (`npm deprecate`, `npm dist-tag`, `npm owner`, `npm unpublish`).
 
 Built and maintained by [Yaw Labs](https://yaw.sh).
 
@@ -17,7 +17,7 @@ One click adds this to your [mcp.hosting](https://mcp.hosting) account so it syn
 
 Other npm MCP servers wrap `npm search` and call it done. This one doesn't.
 
-- **Full registry HTTP surface** — 63 tools across reads, writes, orgs, teams, hooks, provenance, trusted publishers, and ops health. Not just `npm view`.
+- **Full registry HTTP surface** — 64 tools across reads, writes, orgs, teams, hooks, provenance, trusted publishers, and ops health. Not just `npm view`.
 - **Write ops that actually work in agents** — `npm_deprecate`, `npm_dist_tag_set`, `npm_owner_add`, `npm_unpublish_version` go directly to the HTTP API with your token. No 2FA prompts, no `--otp` hunts, no `ENEEDAUTH` from a session-bound `.npmrc`.
 - **Agent-aware failure surfacing** — write tools detect non-interactive context and return specific human-runnable commands (`npm login --auth-type=web`) instead of looping on unrecoverable errors.
 - **Safety by default** — `npm_unpublish_*` requires `confirm: true`. `npm_owner_remove` blocks you from locking yourself out. `npm_deprecate` validates the message format (em-dash, no trailing period) that npmjs.com's API actually accepts.
@@ -112,7 +112,7 @@ That's it. Now ask your AI assistant:
 
 Use the same JSON block shown above in any of these.
 
-## Tools (63)
+## Tools (64)
 
 ### Search (1)
 - **npm_search** — Search the npm registry with qualifiers (keywords, author, scope).
@@ -163,13 +163,14 @@ Use the same JSON block shown above in any of these.
 - **npm_verify_token** — One-call capability check. **Call this first** when debugging write failures.
 - **npm_user_packages** — Packages published by a user.
 
-### Access & orgs (6, requires NPM_TOKEN)
+### Access & orgs (7, requires NPM_TOKEN)
 - **npm_collaborators** — Package collaborators and permissions.
 - **npm_package_access** — Package access settings.
 - **npm_org_members** — Org members and roles.
 - **npm_org_packages** — Org packages.
 - **npm_org_teams** — Org teams.
 - **npm_team_packages** — Team package permissions.
+- **npm_team_members** — Team members and roles.
 
 ### Workflows (2)
 - **npm_check_auth** — Auth health check with headless publish feasibility.
@@ -234,7 +235,7 @@ Call `npm_ops_playbook` at the start of any session to get the up-to-date matrix
 
 ```
 > "Compare fastify vs express vs koa for maintenance health"
-→ npm_compare({ names: ["fastify", "express", "koa"] })
+→ npm_compare({ packages: ["fastify", "express", "koa"] })
 → npm_health({ name: "fastify" }) // ...etc
 ```
 
@@ -276,7 +277,7 @@ Call `npm_ops_playbook` at the start of any session to get the up-to-date matrix
 
 ## Requirements
 
-- Node.js 18+
+- Node.js 20+ (the CI matrix tests 20 and 22; `package.json` declares `engines.node: ">=20"`)
 - (Optional) npm access token for write operations
 
 ## Contributing

package/dist/index.js

@@ -31887,6 +31887,7 @@ var dependencyTools = [
       const maxDepth = input.depth ?? 3;
       const runLimited = createLimiter(10);
       const packumentCache = /* @__PURE__ */ new Map();
+      const failedPackages = /* @__PURE__ */ new Set();
       const resolved = /* @__PURE__ */ new Set();
       const tree = {};
       const warnings = [];
@@ -31894,16 +31895,24 @@ var dependencyTools = [
         const hintKey = `${name}@${versionHint2}`;
         if (resolved.has(hintKey) || currentDepth > maxDepth) return;
         resolved.add(hintKey);
-        let pkg = packumentCache.get(name);
+        let pending = packumentCache.get(name);
+        if (!pending) {
+          pending = runLimited(() => registryGetAbbreviated(`/${encPkg(name)}`)).then((res) => {
+            if (!res.ok) {
+              warnings.push(`Failed to fetch ${name}: ${res.error}`);
+              return null;
+            }
+            return res.data;
+          });
+          packumentCache.set(name, pending);
+        }
+        const pkg = await pending;
         if (!pkg) {
-          const res = await runLimited(() => registryGetAbbreviated(`/${encPkg(name)}`));
-          if (!res.ok) {
-            warnings.push(`Failed to fetch ${name}: ${res.error}`);
+          if (!failedPackages.has(name)) {
+            failedPackages.add(name);
             tree[hintKey] = { version: versionHint2, dependencies: {}, failed: true };
-            return;
           }
-          pkg = res.data;
-          packumentCache.set(name, pkg);
+          return;
         }
         let resolvedVersion;
         if (pkg.versions[versionHint2]) {
@@ -34201,7 +34210,7 @@ var writeTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.11.4" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.11.6" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version" || subcommand === "-v" || subcommand === "-V") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/npmjs-mcp",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "description": "npm registry MCP server — package intelligence, security audits, and dependency analysis for AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",