Get started

Npm for AI agents

npm is the package registry and manager that most JavaScript and Node.js projects use to publish, install, and track dependencies. Developers rely on it to share and reuse code across projects. Connect it once through Arc0, and your agent, or Claude, ChatGPT and Cursor, can use it through one MCP endpoint, limited to what each user approved.

Connect NpmSee the 12 actions ↓
Developer toolsAPI keyMCP + RESTnpmjs.com
AUDIT LOG · NPMPOLICY: acme-support
09:41:07 · claude · u_8f2read
npm.get_registry_meta
Get NPM Registry Meta✓ allowed · 212ms
09:41:08 · claude · u_8f2read
npm.get_registry_changes
Get Registry Changes Feed✓ allowed · 164ms
09:41:09 · claude · u_8f2write
npm.registry_get_root
Get NPM Registry Root Metadata✓ approved · approved by user
09:41:12 · claude · u_8f2destructive
npm.delete_user_token_legacy
Delete User Token (Legacy)✕ blocked · policy: deny
EVERY NPM CALL, ON THE RECORD
01 · USE CASES

What agents do in Npm.

01

Check a package's download trends

Pull download counts for a package over a date range to see if usage is growing or shrinking.

02

Scan for security advisories

Query bulk security advisories for a project's dependencies before a release goes out.

03

Look up package metadata read-only

Fetch a package's metadata and latest version without changing anything in the registry.

02 · ACTIONS

12 Npm actions, graded by risk.

Every Npm action is tagged read, write or destructive, so one policy covers the whole app and new actions inherit the right default.

read

8

Look things up. Allowed by default.

  • npm.get_registry_meta
    Get NPM Registry Meta
  • npm.get_registry_changes
    Get Registry Changes Feed
  • npm.get_version_downloads
    Get NPM Package Version Downloads (Last 7 Days)
  • npm.get_download_range_all
    Get All NPM Packages Download Counts by Period
  • npm.get_download_counts_point
    Get NPM Download Counts Point
  • npm.query_bulk_security_advisories
    Query Bulk Security Advisories
  • npm.get_all_packages_download_point
    Get All Packages Download Count Point
  • npm.get_download_counts_range_package
    Get NPM Package Download Counts Over Date Range

write

3

Create and change things. Allow, or ask the user first.

  • npm.registry_get_root
    Get NPM Registry Root Metadata
  • npm.registry_get_package
    Get NPM Package Metadata
  • npm.registry_search_packages
    Search NPM Packages

destructive

1

Delete, cancel or archive. Ask first, or deny outright.

  • npm.delete_user_token_legacy
    Delete User Token (Legacy)
03 · HOW IT WORKS

Npm in three steps.

  1. 01Your users connect NpmThey add their Npm api key on Arc0 Connect, under your brand. It goes straight into the vault.
  2. 02You set the rulesReads run, writes like “get NPM Registry Root Metadata” can wait for the user, and “delete User Token (Legacy)” can be denied outright.
  3. 03Any agent can actYour agent calls Npm through the Arc0 SDK or MCP, and so can Claude, ChatGPT and Cursor. Every call lands on the audit log.
POLICY.TS
await arc0.policies.set('npm', {
  read: 'allow',
  write: 'ask',        // registry_get_root
  destructive: 'deny',  // delete_user_token_legacy
})

# Claude Code: the same connection, one URL
$ claude mcp add --transport http arc0 \
    https://mcp.arc0.ai/u/u_8f2
04 · AUTH AND DATA

How Npm connects.

Users add their Npm api key on Arc0 Connect. It is encrypted in the vault, never shown to the model, and each user can rotate or revoke it at any time.

The same Npm connection serves your agent over MCP and your own backend over REST and the proxy, so a user connects once. How Arc0 handles credentials →

AUTH
API key
CREDENTIALS
Per-tenant encrypted vault
MODEL SEES
Results only, never credentials
AUDIT LOG
Every call, on every plan
05 · WORKS WITH

Use Npm from any agent.

Claude
ChatGPT
Cursor
Codex
VS Code
OpenAI Agents SDK
Claude Agent SDK
Vercel AI SDK
Mastra
LangGraph
06 · RELATED

More developer tools apps.

GitHub896 actionsSupabase129 actions0CodeKit8 actionsAbly25 actionsAbstract3 actionsAddressfinder17 actionsAddresszen2 actionsAlchemy36 actions
ALL DEVELOPER TOOLS APPS →
07 · FAQ

Npm and Arc0, answered.

Q01

Can I use Npm with Claude, ChatGPT or Cursor?

Yes. Connect Npm to Arc0 once, then add your Arc0 MCP URL to Claude, ChatGPT, Cursor, Claude Code or any other remote-MCP client. Each assistant only gets the Npm actions you allow.

Q02

How do users connect Npm?

Users add their Npm api key on Arc0 Connect. It is encrypted in the vault, never shown to the model, and each user can rotate or revoke it at any time.

Q03

Which Npm actions can my agent take?

12 in total: 8 read, 3 write and 1 destructive, such as “get NPM Registry Root Metadata”. Your policies decide which of them each agent may call.

Q04

Can I stop my agent from deleting things in Npm?

Yes. Actions like “delete User Token (Legacy)” are graded destructive. Set destructive actions to deny, or to ask so the user approves each one, and blocked calls still show up on the audit log.

Q05

Can my own backend call Npm too?

Yes. The same Npm connection is available over REST and through the Arc0 proxy, so your product and your agent share one connection per user.

Get started

Plug Npm into your agent.

Your users connect Npm once, under your brand. Your agent gets 12 actions behind your policies, with every call on the record.

Connect NpmBrowse all apps →

Free to build · MCP + REST · Audit log on every plan