Report what this server can and cannot do: whether a token is configured and where it came from, which npm account it belongs to, whether two-factor authentication is on, whether writes are enabled, and whether a one-time password is currently cached. Call this first when a tool you expected is missing — an absent tool means missing configuration rather than a bug. The trusted_publishing_available field and its blockers list answer, without spending a call, whether the trusted-publisher tools can work at all.

Check a set of package versions against npm's security advisories — the same data npm audit uses, queried directly. Takes a flat map of package name to the versions you have installed, and returns only the packages with advisories against them. Needs no npm token, so it works on an otherwise unconfigured server. The references field is stripped from each advisory: it is about 1.5 KB of markdown links apiece, and url already points at the write-up.