Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add io.github.continuous-actions-go-tokenless -- npx -y go-tokenless@1.1.0รันในเทอร์มินัล
{ "mcpServers": { "io.github.continuous-actions-go-tokenless": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดDelete your NPM_TOKEN. One command switches npm publishing in GitHub Actions to trusted publishing (OIDC). No long-lived token is stored anywhere, and every release gets a provenance badge.
npm is retiring token publishing: from January 2027 a token can no longer publish on its own (npm docs).
Contents
From the root of the repository that publishes to npm:
npx go-tokenless # 1. preview: lists every change and shows a diff, writes nothing
npx go-tokenless apply # 2. edit the workflow and package.json files
Then follow the Next steps it prints: commit the change, connect the package to the workflow on npm, and delete the old secret. Needs Node 22.14+.
Only the lines that need to change are touched: comments, quoting and layout in your workflows are kept, and in package.json only the repository field is edited. Before writing, go-tokenless re-reads both versions and refuses if anything other than the migration would change.
It stops with exit code 1 and writes nothing when a person needs to decide:
pull_request_target, issue_comment, workflow_run and similar triggers. Granting it OIDC would let a fork publish.repository pointing at another repo.Dry runs (npm publish --dry-run) never count as publishing. Steps that publish to GitHub Packages, and GITHUB_TOKEN values, are left alone.
$ npx go-tokenless
go-tokenless: Ready to go tokenless. (acme/widgets)
Changes:
.github/workflows/release.yml
- publish: remove `NODE_AUTH_TOKEN` from job env
- publish: grant `id-token: write`
- publish: raise setup-node from Node 20 to 24 (trusted publishing needs Node 22.14+)
package.json
- widgets: add repository.url git+https://github.com/acme/widgets.git
Next:
1. Run `npx go-tokenless apply` (or apply the diff above) and commit the changes on a branch.
2. Add a trusted publisher for each package. With npm 11.15+ logged in with 2FA, run:
npm trust github widgets --repo acme/widgets --file release.yml --allow-publish --yes
3. Merge, then let the release workflow publish once. Check the new version shows a provenance badge.
4. Delete the old publish token secret (`gh secret delete NPM_TOKEN`) and revoke the token on npmjs.com.
If your installs need private packages from your npm org, give the install steps a read-only token. Publish steps stay token-free:
npx go-tokenless apply --read-token NPM_READ_TOKEN
- run: npm ci
+ env:
+ NODE_AUTH_TOKEN: ${{ secrets.NPM_READ_TOKEN }}
- run: npm publish
Every install step in the release workflow gets it, including separate build and test jobs. Create a granular token on npmjs.com with read-only access to your packages and save it with gh secret set NPM_READ_TOKEN.
Add the Action to CI. It fails the job if a token creeps back into a publish workflow, and the job summary lists the exact fixes:
# .github/workflows/ci.yml
jobs:
tokenless:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v5
- uses: continuous-actions/go-tokenless@v1
# with:
# mode: report # annotate only, never fail
# read-token: NPM_READ_TOKEN # if installs use a read-only token
It runs go-tokenless --json read-only and needs no token. Its status output is already-tokenless, ready, blocked or no-publish-workflow.
go-tokenless is built to be run by coding agents: --json output, clear exit codes, an MCP server and an Agent Skill. Ask your agent: "Move our npm publishing to trusted publishing."
{ "mcpServers": { "go-tokenless": { "command": "npx", "args": ["-y", "go-tokenless", "mcp"] } } }
MCP tools: plan_trusted_publishing (read-only) and apply_trusted_publishing (writes files; no git or network writes). It is listed in the MCP Registry as io.github.continuous-actions/go-tokenless. See also llms.txt and the Agent Skill.
npx go-tokenless [plan | apply | mcp] [options]
Exit codes: 0 ok · 1 blocked (needs a human fix) · 2 usage error · 3 unexpected error.
.github/workflows/*.yml, package.json files and related scripts in the repository you point it at. apply and the apply_trusted_publishing MCP tool write only to workflow and package.json files inside that repository. It never follows links out of the repository.GET requests to https://registry.npmjs.org/<package> to check that each package already exists (--offline or MCP offline: true turns this off). Nothing else is fetched or sent. There is no telemetry.npx -y go-tokenless@<pinned version> mcp.go-tokenless never touches your npm account, secrets or git history. After apply:
npm trust github … commands (npm 11.15+, asks for 2FA), or go to npmjs.com → package → Settings → Trusted publishing.Each error has its own page with causes and fixes: ENEEDAUTH, 404 on PUT, E422 repository.url, still using the token, and the 2FA-bypass notice.
Issues and pull requests are welcome. Run corepack enable && yarn install && yarn check (typecheck, build and end-to-end tests). See AGENTS.md for how the code is laid out, and SECURITY.md to report a vulnerability.
MIT © continuous-actions
Move npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC).
{ "mcpServers": { "io.github.continuous-actions-go-tokenless": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Go Tokenless ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-09 Move npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC).