Developer & CI · wired today
npm, wired into your agent workforce
Build, review and release state is where agents earn their keep. The npm connector is one of 205 executable connectors and gives agents 5 read-only tools, with the credential held in the vault and every call receipted.
Connecting npm takes one credential
You provide token from your npm account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Where to get it: npm's own API documentation ↗ covers creating and scoping the credential.
What agents can run against npm
whoamiIdentify the npm account the stored token belongs to
get_packageGet a package's metadata from the npm registry (abbreviated packument: dist-tags, versions, modified time)
get_package_versionGet one published version's manifest (dependencies, dist tarball info)
get_dist_tagsList a package's dist-tags (latest, next, beta...)
searchSearch the npm registry
Every tool above is read-only. Write surfaces ship only after live testing, and always behind approval gates.
How proven is this?
This connector was blind shape-proven against the real npm API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.
npm integration FAQ
What can Quox agents do with npm?
Agents can run 5 read-only tools against npm: whoami, get package, get package version, get dist tags, search. Every call is receipted in the evidence trail.
What does the npm integration need?
You provide token from your npm account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Do agents see my npm credentials?
No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.
How proven is the npm connector?
This connector was blind shape-proven against the real npm API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.