Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

npm (BYOK) — connector documentation

  • MCP endpoint: https://byok-npm.connectorbay.com/mcp
  • REST API: POST https://byok-npm.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-npm.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own npm npm access token, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-npm.connectorbay.com/health · Tool schemas: https://byok-npm.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-npm · agent@connectorbay.com

What npm (BYOK) is for

npm (BYOK) lets an AI assistant read your own npm data through the npm API with a key you supply (npm access token). Read-only: 11 tools (search_packages, get_package_version, get_version_status, get_package_visibility, list_package_collaborators, list_org_users, list_org_teams, list_org_packages, list_team_users, list_team_packages, list_access_tokens). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to registry.npmjs.org. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by npm. npm and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Find npm packages for parsing command line arguments"
  • "What is the latest version of express and what does it depend on?"
  • "Is lodash 4.17.21 still published?"
  • "Is my package @myorg/core private?"
  • "Who has write access to @myorg/core?"
  • "Who belongs to the myorg npm organization?"

What it does

  • search_packages: Search the npm registry by keywords (supports qualifiers such as author: and keywords:); returns name, version, license, publisher, dates, links and weekly or monthly downloads.
  • get_package_version: Get one published version of a package (use 'latest' for the newest): description, license, homepage, dependencies, tarball URL and publisher.
  • get_version_status: Get the lifecycle status of an exact package version: published, validating, staged, blocked or deleted.
  • get_package_visibility: Show whether a package is public or private (and related access flags) for a package you can see.
  • list_package_collaborators: List the users who can access a package and the access level (read or write) each one has.
  • list_org_users: List the members of an npm organization with their role (owner, admin or developer).
  • list_org_teams: List the names of the teams in an npm organization.
  • list_org_packages: List the packages an npm organization owns with the access level of the calling token (read or write).
  • list_team_users: List the usernames that belong to one team of an npm organization.
  • list_team_packages: List the packages a team can access with the access level (read or write).
  • list_access_tokens: List the calling account's npm access tokens with name, read-only flag, creation, last use, expiry and revocation dates (token values are not returned). Needs a session token, not a restricted access token.

BYOK key

You bring your own npm npm access token (https://docs.npmjs.com/creating-and-viewing-access-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to registry.npmjs.org over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the npm API (registry.npmjs.org) with a BYOK key; documentation: https://api-docs.npmjs.com/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by npm. npm and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your npm account.

Built for: Worldwide. Languages: English.