MCP.Market

go-tokenless MCP server

by Continuous-Actions·io.github.Continuous-Actions/go-tokenless·v1.1.0·2 stars
No reviews yet

Move npm publishing in GitHub Actions from NPM_TOKEN to trusted publishing (OIDC).

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

2 stars136 downloads/wk

Reviews

Write one

Nobody has reviewed go-tokenless yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

go-tokenless tools (2, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • apply_trusted_publishingwrite action

    Writes the workflow and package.json changes from plan_trusted_publishing to disk (no git commit, no network writes). Returns the plan with status "applied" and the steps the user must still do with npm 2FA (npm trust commands, deleting the NPM_TOKEN secret).

  • plan_trusted_publishing

    Read-only. Finds GitHub Actions workflows that publish to npm with a token (NPM_TOKEN / NODE_AUTH_TOKEN) and returns the exact changes needed to switch to npm trusted publishing (OIDC): workflow diff, package.json repository fixes, `npm trust github` commands, and the remaining human steps. Use before apply_trusted_publishing.

Public scan report

scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it

1 medium
  • Code scan5 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 7 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/chunks/mcp-232VFDX2.js: …&&(C=this.opts.code.process(C,g));let Q=new Function(`${o.default.self}`,`${o.default.scope}`…
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How go-tokenless compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 1,119 Developer tools servers
Tools
2
the typical Developer tools server has 7
Tools that change things
50%
typical: 5%. Fewer write tools means less an agent can break
GitHub stars
2
more than 65% of 855 Developer tools servers
Downloads a week
136
more than 64% of 436 Developer tools servers with a package

What its tools let an agent do: 1 read · 1 run or deploy

Install go-tokenless in Claude Code, Cursor or VS Code

Runs npx -y go-tokenless on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add go-tokenless -- npx -y go-tokenless
Add to Cursor

What the publisher says

From the go-tokenless repository's README, as published. We do not edit it. Read it on GitHub

go-tokenless

<!-- Scorecard URLs are case-sensitive: keep the org login "Continuous-Actions". -->

Delete your NPMTOKEN.** One command switches npm publishing in GitHub Actions to trusted publishing (OIDC). No long-lived token is stored anywhere, and every release gets a provenance badge.

npm is retiring token publishing: from January 2027 a token can no longer publish on its own (npm docs).

<!-- toc --> Contents

<!-- /toc -->

  • Quick start
  • What it changes
  • Supported release setups
  • Private packages
  • Keep it tokenless in CI
  • Use it with AI agents
  • Options
  • What it accesses
  • What only you can do
  • Troubleshooting
  • Contributing
  • License

Quick start

From the root of the repository that publishes to npm:

npx go-tokenless          # 1. preview: lists every change and shows a diff, writes nothing
npx go-tokenless apply    # 2. edit the workflow and package.json files

Then follow the Next steps it prints: commit the change, connect the package to the workflow on npm, and delete the old secret. Needs Node 22.14+.

What it changes

Only the lines that need to change are touched: comments, quoting and layout in your workflows are kept, and in package.json only the repository field is edited. Before writing, go-tokenless re-reads both versions and refuses if anything other than the migration would change.

It stops with exit code 1 and writes nothing when a person needs to decide:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

go-tokenless: common questions

Is go-tokenless MCP server safe?
Mostly: it is graded B (83/100). Read the go-tokenless safety report
How do I install go-tokenless?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does go-tokenless need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is go-tokenless maintained?
The last commit was 29 days ago (2026-10-06). The latest release is v1.1.0.
What can I use instead of go-tokenless?
Servers from other publishers that do the same job: Github MCP server, GitDiagram MCP server and GitHub MCP server.
How does go-tokenless compare with other Developer tools MCP servers?
safety score 83/100 (higher than 65% of 1,119 Developer tools servers); tools 2 (the typical Developer tools server has 7); tools that change things 50% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to go-tokenless

Same job from other publishers: the closest match first, then the best rated.

  • Github
    MCP server for GitHub operations (PRs, issues, actions) with structured, token-efficient output
    More from Dave-London →
    A
  • GitDiagram
    Architecture diagrams, explanations and Mermaid source for public GitHub repositories.
    A
  • GitHub
    Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
    A
  • Gk CLI
    The GitKraken MCP Server for managing repos, PRs, issues across GitHub, GitLab, Bitbucket and more.
    B
  • Agent Harnesses
    Agent-harness picks, decision guides, setup templates, and skills; live GitHub/HN discovery.
    A