{"name":"io.github.Continuous-Actions/go-tokenless","slug":"continuous-actions-go-tokenless","title":"go-tokenless","description":"Move npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC).","url":"https://mcp.market/server/continuous-actions-go-tokenless","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"devtools","tags":["devtools"],"presence":{"score":30,"stars":2,"forks":0,"downloads_week":136,"last_push_at":"2026-10-06T20:54:34.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/Continuous-Actions/go-tokenless","website":null,"version":"1.1.0","remotes":[],"packages":[{"registryType":"npm","identifier":"go-tokenless","version":"1.1.0","transport":{"type":"stdio"},"packageArguments":[{"value":"mcp","type":"positional"}]}],"tools":[{"name":"apply_trusted_publishing","description":"Writes the workflow and package.json changes from plan_trusted_publishing to disk (no git commit, no network writes). Returns the plan with status \"applied\" and the steps the user must still do with npm 2FA (npm trust commands, deleting the NPM_TOKEN secret).","write_action":true,"price_micros":0,"input_schema":null},{"name":"plan_trusted_publishing","description":"Read-only. Finds GitHub Actions workflows that publish to npm with a token (NPM_TOKEN / NODE_AUTH_TOKEN) and returns the exact changes needed to switch to npm trusted publishing (OIDC): workflow diff, package.json repository fixes, `npm trust github` commands, and the remaining human steps. Use before apply_trusted_publishing.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":83,"grade":"B","scanned_at":"2026-10-14T05:25:07.322Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-14T05:25:07.361Z","components":{"code":{"score":20,"max":25,"notes":["5 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 7 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/chunks/mcp-232VFDX2.js: …&&(C=this.opts.code.process(C,g));let Q=new Function(`${o.default.self}`,`${o.default.scope}`…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"go-tokenless","version":"1.1.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":0,"publishedAt":"2026-10-06T12:45:50.396Z","repositoryUrl":"git+https://github.com/Continuous-Actions/go-tokenless.git","weeklyDownloads":136}],"repo":{"found":true,"owner":"Continuous-Actions","repo":"go-tokenless","archived":false,"pushedAt":"2026-10-06T20:54:34Z","stars":2,"forks":0,"openIssues":0,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/337897745?v=4","ownerCreatedAt":"2026-10-05T00:45:33Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/337897745?v=4&s=128","source":"github"},"presence":{"stars":2,"forks":0,"downloadsWeek":136,"license":"MIT","lastPushAt":"2026-10-06T20:54:34.000Z","score":30}}}},"grade_history":[],"reviews":[]}