1. Conduid
  2. Developer Tools
  3. Npm Top Provenance
MCP server · Developer Tools

Npm Top Provenance

by · github.com/sxzz/npm-top-publishing

Track OIDC, provenance, and staged publishing adoption across high-impact npm packages.

Unclaimed MIT devtools
InstallView source
64Good

Scored 3 days ago · breakdown

About Npm Top Provenance

Npm Top Provenance is an MCP server published by sxzz in the Developer Tools category: track OIDC, provenance, and staged publishing adoption across high-impact npm packages.

The repository has 36 stars and 1 forks, with the last commit 3 days ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/sxzz/npm-top-publishing

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Npm Top Provenance

Powered by Claude · Grounded in docs

I know everything about Npm Top Provenance. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 4 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

npm Top Publishing

This repository tracks OIDC, provenance, and staged publishing adoption across high-impact npm packages. The package list is sourced from wooorm/npm-high-impact.

The results are generated by checking the publishing metadata for each package and are saved in results.json.

The dashed vertical line and ▲ markers indicate days when the upstream npm-high-impact package list was updated, which changes the set of packages being tracked and can cause discontinuities in the trend.

Results

Generated time: 2026-10-18T00:32:22.512Z

Total packages: 17125

Compact tuples in results.json · Full data with version and author in full-results.json

OIDC + Provenance + Staged

Published via trusted publishing with a provenance attestation and staged publishing. This is currently the most secure way to publish.

Package Downloads
emoji-regex
uuid
undici-types
esbuild
entities
postcss
nanoid
yargs
@babel/types
cookie
@babel/parser
tr46
@babel/helper-validator-identifier
electron-to-chromium
readdirp
@babel/runtime
node-releases
browserslist
@radix-ui/react-primitive
magic-string
@babel/generator
update-browserslist-db
@babel/compat-data
@babel/core
@babel/helpers
tinyglobby
@babel/helper-module-transforms
fastq
@babel/helper-compilation-targets
@babel/helper-string-parser
keyv
mime
caniuse-lite
@smithy/util-utf8
raw-body
baseline-browser-mapping
axios
content-disposition
@opentelemetry/core
type-is
@eslint/eslintrc
express
schema-utils
@smithy/is-array-buffer
@smithy/util-buffer-from
enhanced-resolve
@radix-ui/react-context
@smithy/types
content-type
es-module-lexer
@eslint/plugin-kit View
@babel/helper-globals View
@opentelemetry/api-logs View
@opentelemetry/resources View
@humanfs/node View
node-addon-api View
fast-uri View
@opentelemetry/instrumentation View
@humanfs/core View
fast-xml-parser View
@vitest/utils View
tinyexec View
scheduler View
@babel/traverse View
zod View
jose View
get-tsconfig View
@vitest/spy View
react View
jsdom View
chai View
@babel/code-frame View
proxy-addr View
html-encoding-sniffer View
pnpm View
@radix-ui/primitive View
is-plain-object View
@vitest/expect View
@vitest/pretty-format View
@radix-ui/react-compose-refs View
bl View
@radix-ui/react-use-layout-effect View
protobufjs View
@opentelemetry/sdk-trace-base View
@radix-ui/react-use-controllable-state View
tinyrainbow View
@radix-ui/react-dismissable-layer View
@radix-ui/react-id View
@alloc/quick-lru View
@radix-ui/react-presence View
w3c-xmlserializer View
sharp View
@radix-ui/react-use-callback-ref View
autoprefixer View
strnum View
@vitest/snapshot View
@radix-ui/react-portal View
@radix-ui/react-use-escape-keydown View
import-in-the-middle View
tsx View
@vitest/runner View
@radix-ui/react-collection View
@radix-ui/react-focus-scope View
ast-types View
@smithy/protocol-http View
@radix-ui/react-focus-guards View
@radix-ui/react-popper View
@smithy/fetch-http-handler View
@radix-ui/react-direction View
mdn-data View
@radix-ui/react-visually-hidden View
@radix-ui/react-arrow View
@smithy/signature-v4 View
@babel/helper-member-expression-to-functions View
isobject View
vitest View
@emnapi/runtime View
@babel/helper-create-class-features-plugin View
@radix-ui/react-roving-focus View
@vitest/mocker View
@smithy/property-provider View
webpack-sources View
@smithy/util-middleware View
@radix-ui/react-dialog View
@smithy/querystring-builder View
@radix-ui/react-use-size View
read-cache View
why-is-node-running View
@smithy/smithy-client View
tldts-core View
@napi-rs/wasm-runtime View
@radix-ui/react-use-previous View
pure-rand View
@smithy/middleware-endpoint View
tinybench View
@smithy/shared-ini-file-loader View
dayjs View
recharts View
@octokit/types View
rollup View
@smithy/core View
@smithy/util-base64 View
@smithy/credential-provider-imds View
immer View
@smithy/middleware-serde View
@radix-ui/react-label View
@smithy/url-parser View
@noble/hashes View
@smithy/middleware-stack View
@testing-library/dom View
webpack View
@smithy/util-retry View
serialize-javascript View
@smithy/service-error-classification View
@radix-ui/react-dropdown-menu View
sisteransi View
postcss-nested View
@smithy/querystring-parser View
@smithy/util-stream View
@radix-ui/react-tooltip View
@smithy/node-config-provider View
@octokit/openapi-types View
@smithy/util-uri-escape View
@testing-library/jest-dom View
@tanstack/query-core View
watchpack View
@radix-ui/react-separator View
synckit View
@smithy/middleware-retry View
@smithy/util-hex-encoding View
@radix-ui/react-menu View
@radix-ui/react-select View
@smithy/util-endpoints View
inquirer View
@radix-ui/react-collapsible View
through2 View
@smithy/util-defaults-mode-node View
@radix-ui/react-popover View
node-gyp View
unplugin View
@radix-ui/react-tabs View
@tanstack/react-query View
@smithy/hash-node View
@inquirer/type View
@radix-ui/react-progress View
@babel/plugin-transform-classes View
@radix-ui/react-toggle View
@babel/plugin-transform-block-scoping View
@smithy/util-defaults-mode-browser View
@radix-ui/react-avatar View
regexpu-core View
@babel/plugin-transform-spread View
@smithy/util-body-length-browser View
@babel/plugin-transform-parameters View
@smithy/config-resolver View
@emnapi/wasi-threads View
@radix-ui/react-scroll-area View
@opentelemetry/sdk-metrics View
@babel/plugin-transform-for-of View
@emnapi/core View
@babel/plugin-transform-regenerator View
@testing-library/react View
eventsource-parser View
express-rate-limit View
@babel/plugin-transform-destructuring View
@vitejs/plugin-react View
@radix-ui/react-radio-group View
tinyspy View
@smithy/util-config-provider View
@smithy/middleware-content-length View
@radix-ui/react-alert-dialog View
@inquirer/core View
@inquirer/figures View
@smithy/util-body-length-node View
eslint-plugin-react-refresh View
eslint-plugin-prettier View
he View
b4a View
cac View
@babel/plugin-transform-optional-chaining View
set-cookie-parser View
@babel/helper-create-regexp-features-plugin View
process-warning View
@radix-ui/react-hover-card View
@radix-ui/react-context-menu View
@radix-ui/react-navigation-menu View
@modelcontextprotocol/sdk View
@babel/plugin-transform-typescript View
bare-events View
fast-xml-builder View
use-sync-external-store View
playwright-core View
@babel/plugin-transform-private-property-in-object View
unicode-canonical-property-names-ecmascript View
compression View
@smithy/invalid-dependency View
react-refresh View
zustand View
@babel/preset-typescript View
@radix-ui/react-menubar View
@inquirer/confirm View
@swc/core View
@opentelemetry/otlp-exporter-base View
memfs View
hono View
moment View
unicode-property-aliases-ecmascript View
@babel/plugin-transform-async-generator-functions View
playwright View
@hono/node-server View
@smithy/node-http-handler View
@swc/types View
eventsource View
pino View
tinypool View
@testing-library/user-event View
@smithy/abort-controller View
input-otp View
@octokit/request View
@smithy/util-waiter View
reselect View
@opentelemetry/otlp-transformer View
@opentelemetry/sdk-logs View
svgo View
@opentelemetry/context-async-hooks View
@smithy/eventstream-serde-node View
@radix-ui/react-aspect-ratio View
@oxc-project/types View
@humanfs/types View
@smithy/eventstream-serde-config-resolver View
@inquirer/ansi View
@octokit/request-error View
@next/env View
@octokit/endpoint View
@radix-ui/react-toast View
@octokit/core View
@graphql-tools/utils View
@smithy/eventstream-codec View
regenerate View
obug View
@babel/preset-env View
@octokit/graphql View
@inquirer/external-editor View
@smithy/eventstream-serde-universal View
json-schema-typed View
bare-stream View
@smithy/uuid View
bare-fs View
@octokit/plugin-paginate-rest View
@babel/plugin-transform-class-static-block View
ret View
undici View
bare-path View
tailwind-merge View
secure-json-parse View
http-proxy-middleware View
webpack-dev-middleware View
@smithy/md5-js View
magicast View
@babel/plugin-transform-runtime View
@radix-ui/react-slot View
@inquirer/prompts View
@octokit/plugin-rest-endpoint-methods View
react-router View
react-day-picker View
@smithy/hash-blob-browser View
@inquirer/select View
@inquirer/input View
node-abi View
@opentelemetry/instrumentation-http View
@inquirer/expand View
@smithy/chunked-blob-reader-native View
sass View
@smithy/hash-stream-node View
@vue/shared View
@opentelemetry/instrumentation-mongodb View
openai View
ts-jest View
@inquirer/editor View
@inquirer/number View
@opentelemetry/instrumentation-graphql View
@opentelemetry/instrumentation-pg View
rolldown View
strip-literal View
@opentelemetry/instrumentation-mongoose View
@opentelemetry/instrumentation-mysql View
@opentelemetry/sdk-trace-node View
@opentelemetry/instrumentation-generic-pool View
@smithy/chunked-blob-reader View
highlight.js View
lint-staged View
@inquirer/rawlist View
@opentelemetry/instrumentation-hapi View
@opentelemetry/instrumentation-connect View
react-router-dom View
@opentelemetry/instrumentation-fs View
@radix-ui/react-toggle-group View
@babel/plugin-transform-explicit-resource-management View
@opentelemetry/instrumentation-lru-memoizer View
@vitest/coverage-v8 View
socket.io-parser View
@inquirer/password View
@opentelemetry/instrumentation-knex View
@ai-sdk/provider-utils View
@opentelemetry/exporter-trace-otlp-http View
@inquirer/search View
preact View
@vue/compiler-core View
@opentelemetry/instrumentation-ioredis View
@anthropic-ai/sdk View
@noble/curves View
@opentelemetry/instrumentation-amqplib View
@opentelemetry/instrumentation-tedious View
@ai-sdk/provider View
miniflare View
@opentelemetry/instrumentation-mysql2 View
eslint-config-next View
@vue/compiler-dom View
@supabase/realtime-js View
@smithy/eventstream-serde-browser View
@supabase/auth-js View
@supabase/storage-js View
@fastify/busboy View
@mswjs/interceptors View
@supabase/postgrest-js View
@reduxjs/toolkit View
@opentelemetry/instrumentation-koa View
@formatjs/intl-localematcher View
marked View
@supabase/functions-js View
fast-check View
ast-v8-to-istanbul View
smol-toml View
libphonenumber-js View
postcss-discard-duplicates View
@vue/compiler-sfc View
launch-editor View
@opentelemetry/instrumentation-express View
postcss-minify-selectors View
postcss-discard-empty View
postcss-merge-rules View
@opentelemetry/instrumentation-dataloader View
@opentelemetry/instrumentation-undici View
@graphql-tools/merge View
cssnano View
@puppeteer/browsers View
@graphql-tools/schema View
sass-loader View
postcss-merge-longhand View
postcss-minify-params View
postcss-convert-values View
@radix-ui/react-slider View
postcss-svgo View
bare-url View
postcss-calc View
cssnano-preset-default View
postcss-normalize-whitespace View
stylehacks View
@vue/compiler-ssr View
@tanstack/history View
@vitejs/plugin-react-swc View
postcss-normalize-url View
@faker-js/faker View
postcss-normalize-timing-functions View
@opentelemetry/exporter-logs-otlp-http View
devtools-protocol View
lucide-react View
postcss-unique-selectors View
postcss-normalize-display-values View
@cloudflare/unenv-preset View
postcss-reduce-transforms View
postcss-discard-overridden View
fast-content-type-parse View
postcss-colormin View
pdfjs-dist View
effect View
@opentelemetry/otlp-grpc-exporter-base View
postcss-ordered-values View
package-manager-detector View
postcss-reduce-initial View
postcss-discard-comments View
postcss-minify-gradients View
concurrently View
@opentelemetry/instrumentation-redis View
@opentelemetry/propagator-jaeger View
postcss-normalize-charset View
postcss-minify-font-values View
nodemailer View
react-docgen View
@tanstack/router-core View
postcss-normalize-unicode View
postcss-normalize-positions View
postcss-normalize-string View
postcss-normalize-repeat-style View
@formatjs/icu-skeleton-parser View
@tanstack/router-plugin View
@formatjs/icu-messageformat-parser View
empathic View
intl-messageformat View
@opentelemetry/propagator-b3 View
@tanstack/react-virtual View
tldts View
eslint-plugin-jest View
@tanstack/router-utils View
conventional-commits-parser View
@shikijs/types View
engine.io View
@tanstack/store View
@opentelemetry/instrumentation-kafkajs View
@shikijs/engine-oniguruma View
mocha View
@ioredis/commands View
@inquirer/checkbox View
socket.io View
cssnano-utils View
@bufbuild/protobuf View
@opentelemetry/exporter-metrics-otlp-http View
csv-parse View
cron-parser View
@opentelemetry/exporter-trace-otlp-grpc View
svg-parser View
basic-auth View
@apidevtools/json-schema-ref-parser View
socket.io-adapter View
@tanstack/start-client-core View
@tanstack/start-storage-context View
@tanstack/start-plugin-core View
@tanstack/react-start-server View
@tanstack/react-start-client View
@tanstack/table-core View
graphql-tag View
@tanstack/react-table View
socket.io-client View
bson View
engine.io-client View
@shikijs/langs View
postcss-safe-parser View
chrome-launcher View
@napi-rs/canvas View
@mui/types View
@tanstack/react-start View
@opentelemetry/exporter-trace-otlp-proto View
@shikijs/themes View
webpack-cli View
vue View
@opentelemetry/exporter-metrics-otlp-proto View
@graphql-codegen/plugin-helpers View
@ai-sdk/gateway View
puppeteer-core View
@shikijs/core View
@opentelemetry/exporter-metrics-otlp-grpc View
shiki View
@prisma/get-platform View
metro-source-map View
metro-runtime View
@vue/reactivity View
metro-symbolicate View
ob1 View
@prisma/debug View
@tanstack/react-start-rsc View

OIDC + Provenance

Published via trusted publishing with a provenance attestation.

Package Downloads
semver
emoji-regex
eslint-visitor-keys
which
uuid
undici-types
esbuild
entities
postcss
agent-base
@esbuild/linux-x64
react-is
nanoid
yargs
https-proxy-agent

README fetched from the repository 4 days ago. The original is authoritative.

Questions

About Npm Top Provenance

How do I install Npm Top Provenance?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Npm Top Provenance safe to use with an AI agent?

Its trust score is 64 out of 100 (good). It passes 4 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Npm Top Provenance still maintained?

Yes — the last commit was 3 days ago. The repository has 36 stars and 1 forks.