npm Trusted Publish Lint runs on your own machine — the client starts it, so there is no endpoint to ping. 120 installs a week from npm. Last commit 2 Nov 2026.
Finds the credential in your release workflow that expires before your next release
Today is the operative word: we check npm Trusted Publish Lint every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add npm-trusted-publish-lint -- npx -y @readystack/npm-trusted-publish-lint
{
"mcpServers": {
"npm-trusted-publish-lint": {
"command": "npx",
"args": [
"-y",
"@readystack/npm-trusted-publish-lint"
]
}
}
}
[mcp_servers.npm-trusted-publish-lint]
command = "npx"
args = ["-y", "@readystack/npm-trusted-publish-lint"]
{
"mcpServers": {
"npm-trusted-publish-lint": {
"command": "npx",
"args": [
"-y",
"@readystack/npm-trusted-publish-lint"
]
}
}
}
{
"servers": {
"npm-trusted-publish-lint": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@readystack/npm-trusted-publish-lint"
]
}
}
}
Find the package.json lines that stop vsce before you run the release build
Finds the coverage gates in your repo that can never fail a build
Find the lines your bank will refuse before you send the batch
Finds the lines that make Google Play reject your release - target API below 36, Billing Library bel
Finds the Gov-Client and Gov-Vendor header mistakes HMRC rejects, in your editor, offline, before yo
Find the ISO 20022 postal addresses your correspondent bank will repair by hand, before you send the
Finds the lines KSeF will reject in a Polish structured invoice XML, before you send it
Finds the France-French and left-over English lines in your fr-CA locale file before an OQLF complai
Answers built from our own checks of this server.