The package layer for AI agents.

Nipmod lets agents search npm, PyPI, Hugging Face, GitHub and MCP sources, inspect package trust, and generate safe install plans before workspace writes.

Nipmod does not replace package registries. It makes existing package ecosystems readable and safer for AI agents.

API beta access requires a free beta key.

curl -s -X POST 'https://nipmod.com/api/keys/beta'
curl 'https://nipmod.com/api/search?q=http%20client&limit=3' -H 'x-nipmod-api-key: <key>'
curl 'https://nipmod.com/api/inspect?source=npm&name=undici' -H 'x-nipmod-api-key: <key>'
curl 'https://nipmod.com/api/install-plan?source=npm&name=undici' -H 'x-nipmod-api-key: <key>'

Tell an agent:

Use Nipmod before choosing a package.
Search sources, inspect the selected record and show the install plan.
Do not install or edit files until I approve.

Copyable HTTP client examples:

node --experimental-strip-types examples/http-api/agent-flow.ts "http client"
python3 examples/http-api/agent_flow.py "http client"

Agents can choose dependencies, write code, run commands and modify real workspaces. Package metadata was written for humans and package managers, not for autonomous agents that need structured source context before taking action.

Nipmod gives agents one preflight surface:

1. Search supported sources.
2. Inspect exact package records.
3. Generate an install plan.
4. Wait for user or host-policy approval.
5. Optionally confirm useful discovery into the package intelligence archive.

Search ranking is never install permission. A popular package can still be compromised, stale, risky or blocked by policy.

Nipmod does not bulk mirror these sources. Source owners keep ownership.

curl 'https://nipmod.com/api/search?q=http%20client&sources=npm,pypi,github,huggingface-model,mcp&limit=5' \
  -H 'x-nipmod-api-key: <key>'

Search returns candidates, source reports, partial failure state and agent-readable ranking data. Search records are ephemeral by default.

curl 'https://nipmod.com/api/inspect?source=npm&name=undici' \
  -H 'x-nipmod-api-key: <key>'

Inspect refreshes one exact source-owned record and returns source URL, license, metrics, warnings, trust factors and policy output.

curl 'https://nipmod.com/api/install-plan?source=npm&name=undici' \
  -H 'x-nipmod-api-key: <key>'

Install plans describe commands, risk, warnings and approval boundaries. The hosted API never executes commands and never writes to the caller workspace.

nipmod deep-scan . --json

Deep scan is a local static pass over files already present on disk, including supported local package artifacts such as .tgz, .tar.gz, .zip and .whl. It is for the second stage after hosted search, inspect and install-plan. It does not download packages, clone repositories, extract files to disk, install dependencies, execute code or write to the workspace.

curl 'https://nipmod.com/api/archive/prepare?source=npm&name=undici' \
  -H 'x-nipmod-api-key: <key>'

Archive prepare is preview-only. Durable archive writes require explicit confirmation through an authorized writer path. Confirmed records are deduplicated by source, name, version and source evidence.

External trust scores use the public external-v2 policy.

Popularity can affect ranking, but it never upgrades security confidence. See trust scoring.

Nipmod uses explicit lifecycle language:

Current API wire statuses are documented in archive records. The public product language should use the lifecycle states above.

pnpm install
pnpm verify

Useful focused checks:

pnpm --dir site test -- package-intelligence.test.ts external-packages.test.ts
pnpm api:contract -- --base-url https://nipmod.com
pnpm install-plan:canary -- --base-url https://nipmod.com
pnpm archive:canary -- --base-url https://nipmod.com --require-durable
pnpm launch:verify -- --skip-local --require-distributed-rate-limit

The CLI is optional for hosted API use. Install it only when a local workflow needs controlled workspace actions, audits, SBOM output or local MCP.

curl https://nipmod.com/i|bash

Manual checksum verification:

curl -fLO https://nipmod.com/install.sh
curl -fLO https://nipmod.com/install.sh.sha256
shasum -a 256 -c install.sh.sha256
bash install.sh

• Architecture
• Product positioning
• API: search, inspect, install plan
• Trust scoring
• Package intelligence lifecycle
• Package intelligence seed v1
• Threat model
• Data retention
• Package metadata is untrusted
• Public API spec
• Source resolver spec
• Source crawling spec
• Trust signals spec
• API beta launch kit
• API beta post
• Agent workflow examples

Release sidecars are published under site/public/releases/:

• .sha256 checksums
• .sig signatures
• .sbom.json SBOM metadata
• .provenance.json provenance metadata

See release process for the verification flow.

• Governance: GOVERNANCE.md
• Maintainer: Hazar Kemal Okur
• Maintainer policy: MAINTAINERS.md
• Roadmap: ROADMAP.md
• Contributing: CONTRIBUTING.md
• Security: SECURITY.md

License: MIT. Trademark and affiliation notice: TRADEMARKS.md.