What does this skill do, and when should you use it?
node-modules-inspector, by Anthony Fu, is a CLI plus MCP server that analyzes the node_modules actually installed in the current project. It produces three structured reports: packages installed in multiple versions, packages sorted by install size, and dep-upgrade opportunities plus publint findings grouped by consumer and author. The core analysis is entirely local — no registry calls required (npm metadata only enriches the maintainers report, gated by config). It works with pnpm, npm, and bun projects, and the same three reports are available via npx CLI commands or as MCP tools over stdio for AI agents.
- Reads the project's on-disk node_modules dependency tree (default traversal depth 8)
- Produces a duplicates report: packages installed at multiple versions, sorted by version count descending
- Produces a sizes report: packages ranked by bytes, broken down by category (js, dts, , etc.)
- Produces a maintainers report: dep-upgrade opportunities where a newer installed version exists outside the declared range, plus publint errors/warnings/suggestions
- Emits pipe-safe JSON via
--(logs go to stderr), or exposesnmi:report-duplicates,nmi:report-sizes,nmi:report-maintainersas MCP tools - Caches npm metadata to disk after the first run, making subsequent runs much faster
- A Node/frontend developer slimming a monorepo who wants to know which packages take up the most disk space in node_modules
- An engineer on a pnpm project verifying which packages are installed in multiple versions before running `pnpm dedupe`
- A library author checking whether dependents still declare outdated dependency ranges and how far migration has progressed (migrationRatio)
- A team wanting to find all publint packaging issues across their dependency tree
- A developer using Claude Code or another MCP client who wants repeated dependency queries in one session with the tree cached
- A CI pipeline generating a static analysis artifact via the `build` subcommand (SPA in dist/__node-modules-inspector/)
- Registry-only questions (latest version, metadata) — the source directs those to `fast-npm-meta`
- Bundle-size analysis of a single package — use a bundler-specific tool
- Security audits — use `npm audit` or `osv-scanner`
- Projects using package managers other than pnpm, npm, or bun
How do you install this skill?
- Nothing was executed: all report output shapes are documentation claims only; verify with report -- on a test project before relying on them.
- The tool runs via npx as a third-party npm package; supply-chain integrity depends on npm distribution, and the publisher is not registry-verified.
- The maintainers report fetches npm metadata and caches it in the user's home directory, which may be unreachable or slow from mainland-China networks; publint requires explicit config enablement.
- Docs are English-only with no Chinese-language support declared; the online version (node-modules.dev) depends on WebContainer and may be unreachable on some networks.
- Shell / CLI
- Local filesystem
- MCP Server
Node.jspnpm/npm/bun lockfile with installed node_modules
No separate install is needed — run via npx. In projects using skills-npm, the skill is symlinked into your agent's skill directory after pnpm install.
Claude Code / any MCP client
npx node-modules-inspector mcpDirect CLI use
npx node-modules-inspector report duplicates --How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Audit my dependencies and find any packages installed in multiple versions
- What's taking up the most disk space in node_modules? Show the top 20
- Which dependencies have outdated declared ranges that most other consumers already migrated past?
- Show me all publint issues across my dependencies
Trigger via natural language ("audit my dependencies", "find duplicate packages"). The agent can run CLI report commands:
npx node-modules-inspector report duplicates --
npx node-modules-inspector report sizes -- --limit 20
npx node-modules-inspector report maintainers -- --sort migrationOr start the MCP server and call tools like node-modules-inspector:nmi:report-duplicates. All reports share --root <dir>, --config <file>, --depth <n>, and --; duplicates adds --min-versions; sizes excludes workspace packages by default (--include-workspace to add them); maintainers supports --author, --no-publint, --no-latest-only, and --sort <depth|migration|latest>. Publint findings require publint: true in node-modules-inspector.config.ts. Prefer MCP mode when making multiple queries (the tree is read once and cached); prefer CLI -- for shell pipelining.
What are this skill's strengths and limitations?
- Three reports share one analysis pipeline with identical CLI and MCP output; `--` is pipe-safe (logs to stderr)
- Core analysis is local — no registry network calls needed
- Supports pnpm, npm, and bun, including pnpm catalog references
- npm metadata is cached on disk after first run for faster subsequent runs
- Only pnpm, npm, and bun are supported; other package managers await community contribution
- Publint findings require manually enabling `publint: true` in config, otherwise the maintainers report may be empty
- Full-monorepo analysis can be slow; use `--root packages/<name>` to target a single workspace package
- MCP mode requires a client that supports stdio MCP servers
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Node Modules Inspector — Dependency Audit Skill this page | 67 · Recommended | ★ 3k | 1mo ago | MIT |
| Engram Persistent Memory Protocol | 68 · Recommended | ★ 7.2k | 11d ago | MIT |
| Vexor Semantic Code Search | 60 · Recommended | ★ 244 | 23d ago | MIT |
| Engram Architecture Guardrails | 50 · Use with care | ★ 7.2k | 11d ago | MIT |
| OfficeCLI Skill | 38 · Not recommended | ★ 32k | 13d ago | Apache-2.0 |
The source notes the project is heavily inspired by npmgraph and draws explicit boundaries: registry metadata queries belong to fast-npm-meta, security audits to npm audit/osv-scanner, and single-package bundle analysis to bundler tools — this skill focuses on structured audits of locally installed node_modules.
How did FollowSkills review this skill?
SKILL.md describes read-only analysis of local node_modules with no registry writes, no credential access, no destructive operations; npm metadata fetching is config-gated and disclosed, and the on-disk cache location is documented. Deductions: the tool ships via npx from npm with unverified publisher identity, and the skill itself declares no confirmation/rollback mechanism.
Internally consistent docs (CLI/MCP parity, explicit JSON shapes, stderr logging for pipe safety) plus a failure-modes section with interpretable feedback for three abnormal cases; the repo contains vitest tests (bun dependency-listing fixtures, module-type snapshots) and cross-platform CI. Deductions: static review did not execute; report subcommand outputs were not reproduced, and tests do not directly cover the report/mcp surface.
Trigger phrases and non-fit boundaries (explicitly excluding registry-only questions, bundle analysis, security audits) are exceptionally clear; supports pnpm/npm/bun. Deductions: docs are English-only with no Chinese support statement; reachability of npx/npm dependency fetching from mainland-China networks is unverified, and the maintainers report depends on npm metadata fetches that may be affected.
Good layering: frontmatter summary → table → per-report details → MCP → failure modes → Web UI progressive disclosure; clear MIT license, version 2.4.4, active CI, skill packaged via prepack with a defined update path. Deductions: no changelog evidence in provided files; some configuration details (experimental publint, config options) are deferred to jsdoc.
Three reports with clear goals, complete JSON output shapes and options; clear marginal value over manually inspecting node_modules, with follow-up guidance like dedupe. Deductions: static review cannot verify outputs are directly usable; effectiveness claims lack executed evidence and are capped by the static ceiling.
The repo provides auditable primary material: MIT license, CI workflows, committed tests with fixtures covering core pipeline (dependency listing, module type). Deductions: tests do not cover the skill's key paths (report CLI/MCP tool outputs), static review could not independently reproduce, and cross-source corroboration is limited, so the score stays below the ceiling.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →