Go Tokenless

What go-tokenless MCP server does

go-tokenless helps convert GitHub Actions workflows that publish npm packages with long-lived credentials to npm trusted publishing. The go-tokenless MCP server examines release workflows, package.json files, package scripts, and related local actions to identify the changes required for OIDC-based publishing.

It can remove publish-time NPM_TOKEN or NODE_AUTH_TOKEN settings, add the id-token: write permission, configure npm's registry URL, update incompatible publishing actions, and adjust Node or npm versions when required. It can also remove scripts that write authentication tokens to .npmrc and add or correct the package repository metadata used by npm's trusted publisher configuration.

The migration supports common npm, pnpm, Yarn Berry, Changesets, semantic-release, release-please, Lerna, Nx, release-it, and JS-DevTools/npm-publish arrangements when their documented requirements are met. Yarn 1 and Bun publishing are flagged because the README states they cannot use trusted publishing yet.

How it works

The MCP interface exposes two tools:

• plan_trusted_publishing performs a read-only analysis.
• apply_trusted_publishing writes the proposed migration to local files.

The go-tokenless MCP server does not perform git operations or network writes. Applying changes is deliberately limited to the repository files it can analyze. The command-line interface also supports a preview followed by an explicit apply operation, and JSON output is available for agent workflows.

Before writing, the tool compares the intended edits and refuses to continue if unrelated content would change. It stops instead of modifying files when publishing could be reachable by outsiders, when a self-hosted runner is used, when the repository metadata points elsewhere, when YAML anchors make edits ambiguous, or when it cannot locate a hidden publish command. Dry-run publishes and GitHub Packages steps are treated separately from npm publishing.

Setup and configuration

Run the MCP server through Node and npx:

{
  "mcpServers": {
    "go-tokenless": {
      "command": "npx",
      "args": ["-y", "go-tokenless", "mcp"]
    }
  }
}

The README specifies Node 22.14 or newer for the command-line workflow. Claude Code can add it with claude mcp add go-tokenless -- npx -y go-tokenless mcp. Gemini CLI can install the repository extension, while Cursor and VS Code can use the generic MCP configuration.

No environment variable is required to run the server. If release-workflow install steps need private npm packages, an optional read-only secret such as NPM_READ_TOKEN can be supplied for those install steps; publishing remains token-free.

Tools and capabilities

The go-tokenless MCP server can inspect regular and reusable workflows, workspaces, package scripts, shell scripts, Make targets, and local composite actions. It accounts for workflow working directories and can identify callers of reusable workflows that need separate npm trusted publisher configuration.

For private dependencies, the migration can add a read-only token to installation steps across the release workflow. A separate GitHub Action mode can run the analysis in CI and report whether a repository is already tokenless, ready, blocked, or has no publish workflow, although that Action is distinct from the MCP tool interface.

Limitations and notes

The tool prepares repository changes but does not complete the external npm setup. After applying the migration, maintainers must connect each package to its GitHub workflow as a trusted publisher, merge and run a release, then delete and revoke the old publish token. npm's trusted publisher configuration also depends on supported Node, npm, and publishing-tool versions.

Self-hosted runners are not accepted by npm for trusted publishing. Workflows triggered through mechanisms such as pull_request_target, issue_comment, or workflow_run may be blocked because granting OIDC could allow an external actor to publish. The tool also leaves GITHUB_TOKEN values and GitHub Packages publishing steps unchanged.