io.github.CloudCorpRecordsPublished by GitHub account CloudCorpRecordsv0.1.0Updated Oct 25, 2026
Pre-publish npm pack auditor: shipped files, size, secret-pattern leaks, missing fields.
A local MCP server that audits an npm package directory before publishing, checking shipped files, size, secret patterns and package.json fields.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Follow the launch instructions in the repository.
Audit a package directory before npm publish, while a bad publish is
still cheap to undo.
npmpreflight resolves the file set your package would actually ship,
scans the shipped files for secret patterns, totals the size, and checks
package.json for the fields and entry points a publish depends on. It
answers the questions that are embarrassing to discover after a release:
is a credential sitting in a shipped file, does the bin target exist
in the tarball, is the license field set, and is a scoped package about
to publish as restricted.
Run it without installing:
Or install it globally:
Requires Node 20 or newer.
check [path] audits the package directory at path (default: the
current directory) and prints a human readable report. Add --json
for the machine readable report.mcp starts the MCP server over stdio (see below).--version prints the version.Exit codes: 0 when the verdict is READY, 1 for any other verdict,
2 for a usage error or an unreadable or invalid package.json, and
141 when the reader closed the output pipe early.
Example output:
Findings never include the matched secret text. The evidence for a secret finding is the pattern id only, plus the file and line, so a report is safe to paste into an issue or a CI log.
The same audit is available as an MCP tool over stdio:
preflight_packagepath, the package directory to checkcheck --jsonStart it with npmpreflight mcp, or configure an MCP client to run
npx @reneturcios/npmpreflight mcp. The server is also published as an
OCI image and listed in server.json under the name
io.github.CloudCorpRecords/npmpreflight.
Every report counts the shipped files and their total bytes, plus the finding totals by severity.
READY when there are no high severity findings. Medium, low, and
info findings are reported but do not block the verdict.FIX-FIRST when at least one high severity finding exists.package.json has a files array, those paths are included:
files are added directly and directories are walked recursively.
package.json, README, and LICENSE are always included when
present, whether or not they are listed, matching npm.files array, everything in the directory is included
except node_modules, .git, and paths matched by .npmignore
when one is present. The always included files above are still
included even if an ignore rule would match them.truncated: 1, with
filesSeen and maxFiles) and the render notes that the remaining
files were not scanned.Read these before trusting a clean verdict:
npm pack.
npm applies more rules (its own always excluded files, lifecycle
generated files, and publish time behaviour) that a static pass does
not reproduce. Treat npmpreflight as a preflight check, then confirm
a release with npm pack --dry-run..npmignore support is a simple subset: blank lines, # comments,
plain lines (a file name at any depth, or an exact relative path),
and directory patterns ending in /. Globs, negations, and
character classes in .npmignore are not supported and such lines
will not match the way npm would match them.files entries support literal files, literal directories, simple
* and ** globs, and ! negations of those. Anything more exotic
is resolved literally and may differ from npm.MIT
Source: README.md at commit 33914be
Audit a package directory before publishing: resolves the shipped file set from the files field and ignore rules, scans shipped files for secret patterns (private keys, token shapes), totals the size, and checks package.json for required fields, a bin target that exists, license, and publishConfig on scoped names. Verdict READY or FIX-FIRST with evidence.
pathrequired90% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
npx @reneturcios/npmpreflight check .npm install -g @reneturcios/npmpreflightnpmpreflight check .npmpreflight check [path] [--json]npmpreflight mcpnpmpreflight --versionnpmpreflight check .: FIX-FIRST files: 4, bytes: 603, findings: 2 (high: 2, medium: 0, low: 0, info: 0) summary: 4 shipped file(s), 603 byte(s), 2 finding(s) (2 high, 0 medium, 0 low, 0 info). High-severity findings must be fixed before publishing. [HIGH] SECRET-LEAK src/index.js:2 Shipped file matches the secret pattern private-key-block. Remove the credential from the package and rotate it if it was ever real. (evidence: private-key-block) [HIGH] SECRET-LEAK src/index.js:3 Shipped file matches the secret pattern github-pat-classic. Remove the credential from the package and rotate it if it was ever real. (evidence: github-pat-classic)FIX-FIRST: resolve the high-severity findings before publishing.npm installnpm run buildnpm test